{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-107174 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-107174 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-107174 is a medium-severity path traversal vulnerability in Red Hat OpenShift Serverless, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-107174 and fix it if it is affected.\n\nWhat it is: CVE-2026-107174 is a medium-severity path traversal vulnerability in Red Hat OpenShift Serverless, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-107174 in the wild and no public exploit code.\n\nAffected product: Red Hat OpenShift Serverless. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-107174/ (Markdown: https://insights.sbomify.com/CVE-2026-107174/index.md)","id":"CVE-2026-107174","markdown":"https://insights.sbomify.com/CVE-2026-107174/index.md","name":"CVE-2026-107174","record":{"aliases":["GHSA-rp44-r78q-h2wp"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"OpenShift Source-to-Image","requires_auth":"low_privilege","summary":"Attackers can bypass sandbox boundaries via malicious symbolic links in builder images, leading to unauthorized file access or modification on the host.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":6.4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-61","name":"UNIX Symbolic Link (Symlink) Following"}],"description":"A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction","id":"CVE-2026-107174","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes","id":"CVE-2026-107175"},"packages":[],"prev":{"headline":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","id":"CVE-2026-107172"},"products":["OpenShift Serverless","OpenShift Source-to-Image (S2I)","Red Hat OpenShift Container Platform 4","Red Hat Web Terminal"],"published":"2026-10-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-07","vendors":["Red Hat"]},"summary":"Attackers can bypass sandbox boundaries via malicious symbolic links in builder images, leading to unauthorized file access or modification on the host.","url":"https://insights.sbomify.com/CVE-2026-107174/"}