CVSS 9.3: Unauthenticated gvproxy Path Traversal Deletes Host Files in Red Hat

A critical security flaw in gvproxy, the network forwarder component of the gvisor-tap-vsock package, exposes host systems to arbitrary file deletion. The vulnerability, tracked as CVE-2026-107935, carries a CVSS score of 9.3, indicating a severe risk. According to National Vulnerability Database records, the issue allows an attacker to delete any file on the host system by exploiting a lack of input validation on a specific network endpoint. This defect impacts several Red Hat products, creating a significant exposure for users of these platforms.

How does the vulnerability work?

The core issue is a path traversal vulnerability, classified under CWE-22. The gvproxy service includes an endpoint at /services/forwarder/expose. This endpoint is designed to handle socket paths provided by callers. However, the source material indicates that this endpoint does not validate the caller-supplied socket path.

Because the endpoint is unauthenticated, any network user with access to the service can send malicious requests. By crafting a specific path traversal string, an attacker can bypass intended directory restrictions. This manipulation allows the application to interpret the input as a command to delete files outside the intended scope, effectively granting the attacker the ability to remove arbitrary files on the host system.

Which products are affected?

The vulnerability affects the gvisor-tap-vsock package, specifically the gvproxy component within it. According to the NVD records, the following Red Hat products are listed as affected: Red Hat Build of Podman Desktop, Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Edge Manager 1, and Red Hat Enterprise Linux 10. The listing for Red Hat Enterprise Linux 10 appears multiple times in the source data, confirming its inclusion in the affected scope. Users of these specific Red Hat builds and certification programs should consider their systems potentially vulnerable if they are running the unpatched gvproxy component.

What is the severity rating?

The Common Vulnerability Scoring System (CVSS) rate this flaw as 9.3, which falls into the Critical category. This high score reflects the ease of exploitation (unauthenticated access) and the severe impact on the system (arbitrary file deletion). The lack of authentication means an attacker does not need valid credentials to trigger the exploit. The ability to delete arbitrary files can lead to system instability, loss of critical data, or further compromise if key security files are removed. The combination of network accessibility and high-impact consequences drives the critical severity rating.

What is the current status of fixes?

The source material provided does not confirm the availability of a patch, fix, or update for CVE-2026-107935. In the absence of confirmed vendor patches, users cannot apply a software update to resolve the issue. Organizations relying on the affected Red Hat products should monitor official channels for vendor announcements regarding remediation. Until a fix is confirmed and deployed, the risk remains active for systems running the vulnerable gvproxy component.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: gvproxy

• Audit network access controls to restrict reachability of the /services/forwarder/expose endpoint to trusted networks only.
• Monitor system logs for unusual file deletion events or repeated access attempts to the gvproxy service.
• Verify if your Red Hat product version is listed in the affected scope and contact vendor support for status updates.
• Implement network segmentation to isolate containers or services using gvisor-tap-vsock from general network traffic.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107935?

It is a critical path traversal vulnerability in gvproxy that allows unauthenticated attackers to delete arbitrary files on the host system.

Which Red Hat products are affected?

Affected products include Red Hat Build of Podman Desktop, RHEL 9, RHEL 10, and Red Hat Edge Manager 1.

Is there a patch available?

The source material does not confirm that a patch or fix has been released for this vulnerability.