Critical Path Traversal Flaw in gvproxy Allows Host File Deletion

A critical path traversal vulnerability in gvproxy, the network forwarder component of the gvisor-tap-vsock package, allows attackers to delete arbitrary files on a host system. The flaw, tracked as CVE-2026-107935, has been assigned a CVSS score of 9.3, placing it in the critical severity category.

The vulnerability exists within the unauthenticated /services/forwarder/expose endpoint. According to the National Vulnerability Database (NVD) record, this endpoint fails to validate the caller-supplied socket path. This lack of validation enables an attacker to traverse the directory structure and delete files on the host system. The weakness is classified under CWE-22, which covers Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Because the endpoint is unauthenticated, an attacker does not need valid credentials to exploit the flaw, significantly lowering the barrier for malicious activity.

Context and Background

The gvisor-tap-vsock package provides networking capabilities for virtualized environments, with gvproxy acting as the network forwarder. The discovery of this flaw highlights the risks associated with unvalidated inputs in network-facing components, even those intended for internal or virtualized communication channels.

The NVD record explicitly notes that the issue stems from the failure to sanitize the socket path provided by the caller. This allows the manipulation of file paths beyond the intended directory, leading to arbitrary file deletion. No specific exploit code or active wild exploitation has been mentioned in the source material, but the high severity score indicates significant potential impact.

Who Is Affected

The NVD record lists several Red Hat products as affected by CVE-2026-107935. These include Red Hat Enterprise Linux 10, Red Hat Build of Podman Desktop, Red Hat Certification Program for Red Hat Enterprise Linux 9, and Red Hat Edge Manager 1. The presence of RHEL 10 in the affected list suggests that recent or upcoming releases are vulnerable. Users of these Red Hat distributions and associated tools should verify if their specific versions are impacted. The source material does not specify other vendors or products, so the confirmed impact is limited to the listed Red Hat ecosystem components.

What should you do?

Organizations using the affected Red Hat products should immediately assess their exposure to this vulnerability. Since no patch or fix has been confirmed yet in the source material, users must rely on mitigation strategies. It is crucial to monitor official channels from Red Hat for updates regarding a security advisory or patch release. Until a fix is available, limiting network access to the vulnerable service can reduce the risk of exploitation.