CVE-2026-57966

Katalog CVE

CVSS 4.4 · Medium EPSS 0,13%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada redhat enterprise linux, spice-space spice-vdagent. Skor CVSS 3.1 4.4 (Medium) menurut redhat.com.

Deskripsi (NVD)

A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.

Rincian

Terbit di NVD

29 Juni 2026

Terakhir diubah

8 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-57966 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2493582 issue tracking · advisory vendor