gvproxy Path Traversal Bug Lets Attackers Delete Host Files

A critical path traversal vulnerability in gvproxy, the network forwarder component of the gvisor-tap-vsock package, allows attackers to delete arbitrary files on host systems. The flaw, tracked as CVE-2026-107935, carries a CVSS score of 9.3 and is classified as Critical severity.

How it unfolded

• The vulnerability was identified in the gvproxy service, which handles network forwarding for gvisor-tap-vsock.
• Security researchers found that the /services/forwarder/expose endpoint does not validate caller-supplied socket paths.
• This lack of validation enables unauthenticated attackers to traverse directories and delete files on the host system.

Who is affected

Multiple Red Hat products are impacted by this vulnerability. According to National Vulnerability Database records, affected software includes Red Hat Build of Podman Desktop, the Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Edge Manager 1, and Red Hat Enterprise Linux 10. The widespread use of these enterprise-grade tools means many managed service providers may have clients exposed to this risk.

The fix

No patch or update has been confirmed yet. Users of affected Red Hat products should monitor official Red Hat security advisories for remediation guidance. Until a fix is available, reducing exposure to the vulnerable endpoint is recommended.

What to do and how to stay safe: gvproxy

• Audit network configurations to restrict access to the /services/forwarder/expose endpoint.
• Implement network segmentation to isolate systems running gvproxy from untrusted networks.
• Monitor file system integrity alerts for unexpected deletions on host systems.
• Review logs for unauthorized access attempts to the vulnerable endpoint.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107935?

It is a critical path traversal vulnerability in gvproxy that allows unauthenticated attackers to delete arbitrary files on the host system.

Which Red Hat products are affected?

Red Hat Build of Podman Desktop, Red Hat Certification Program for RHEL 9, Red Hat Edge Manager 1, and Red Hat Enterprise Linux 10 are affected.

Is there a fix available?

No fix has been confirmed yet. Users should wait for an update from Red Hat.