CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write
An attacker can read and write arbitrary host files via the hostDisk feature, requiring specific configuration to exploit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64324?
CVE-2025-64324 is a high-severity path traversal vulnerability in kubevirt, published on 18 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.
Which versions are affected by CVE-2025-64324?
5 open source packages ship an affected version, including kubevirt.io/kubevirt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kubevirt.io/kubevirt Go | All versions | 1.6.1, 1.7.0-rc.0 |
kubevirt.io/kubevirt Go | All versions | 1.6.1 |
kubevirt.io/kubevirt Go | All versions | 1.6.1 |
kubevirt.io/kubevirt Go | From 1.7.0-alpha.0 | 1.7.0-rc.0 |
kubevirt.io/kubevirt Go | From 1.7.0-alpha.0 | 1.7.0-rc.0 |
Products include Kubevirt Kubevirt.
How do I fix CVE-2025-64324?
Upgrade kubevirt.io/kubevirt to a fixed version for your release line: 1.6.1 or 1.7.0-rc.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-64324 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64324 exists.
Other vulnerabilities in kubevirt
- CVE-2020-14316 Privilege Escalation in kubevirt
- CVE-2022-1798 Path Traversal vulnerability in Kubevirt
- CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
- CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12
- CVE-2025-64436 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
Sources
Also known as AZL-70414, AZL-70463, GHSA-46xp-26xh-hpqh, GO-2025-4110, MINI-2xm8-mcqj-cc35, MINI-f6cj-3wqj-m9f8 and 2 more.