CVE-2025-64437 KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
Attackers controlling the virt-launcher pod filesystem can change ownership of arbitrary host files via symlink exploitation, compromising host data integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64437?
CVE-2025-64437 is a medium-severity path traversal vulnerability in kubevirt, published on 7 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.
Weakness: CWE-59
Which versions are affected by CVE-2025-64437?
5 open source packages ship an affected version, including kubevirt.io/kubevirt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kubevirt.io/kubevirt Go | All versions | 1.5.3, 1.6.0-beta.0.0.20250801202148-3ce9f41c54d0 |
kubevirt.io/kubevirt Go | All versions | 1.5.3 |
kubevirt.io/kubevirt Go | All versions | 1.5.3 |
kubevirt.io/kubevirt Go | From 1.6.0-alpha.0 | 1.6.1 |
kubevirt.io/kubevirt Go | From 1.6.0-alpha.0 | 1.6.1 |
Products include Kubevirt Kubevirt.
How do I fix CVE-2025-64437?
Upgrade kubevirt.io/kubevirt to a fixed version for your release line: 1.5.3, 1.6.0-beta.0.0.20250801202148-3ce9f41c54d0 or 1.6.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-64437 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64437 exists.
Other vulnerabilities in kubevirt
- CVE-2020-14316 Privilege Escalation in kubevirt
- CVE-2022-1798 Path Traversal vulnerability in Kubevirt
- CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write
- CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
- CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12
Sources
Also known as AZL-69805, AZL-69970, GHSA-2r4r-5x78-mvqf, GO-2025-4102, MINI-6wqx-5pj7-6hg8, MINI-hvp4-48v9-6fc5.