CVE-2026-9804

Aliases:GHSA-mpmf-3w4r-qfpfGO-2026-5883
Advisory lineage Upstream: 0 Downstream: 5
Awaiting Analysis
Published: 28 May 2026, 08:15
Last modified:21 Jul 2026, 12:05

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.7 HIGH
v3.1 (cve.org)
EPSS Score
0.52% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 May 2026, 08:15
Published
Vulnerability first disclosed
21 Jul 2026, 12:05
Last Modified
Vulnerability information updated

Description

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

CVSS Metrics

  • v3.1•HIGH•Score: 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.52%• Percentile: 40%

Techniques & Countermeasures

  • CWE-59•Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Systems

  • kubevirt.io•kubevirt

    ≤ 1.9.0-beta.0 | all

References (12)