CVE-2026-107935 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
An unauthenticated attacker can delete arbitrary files on the host system via path traversal in the gvproxy expose endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107935?
CVE-2026-107935 is a critical path traversal vulnerability in Red Hat Build of Podman Desktop, published on 9 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
Weakness: CWE-22
Which versions are affected by CVE-2026-107935?
How do I fix CVE-2026-107935?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-107935 being exploited?
There is no known exploitation of CVE-2026-107935 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-107935, DEBIAN-CVE-2026-107935, GHSA-hp8g-9vjx-j62m, UBUNTU-CVE-2026-107935.