{"cve":"CVE-2026-9804","nvd":{"published":"2026-05-28T09:16:49.500","modified":"2026-10-26T11:10:00.157","status":"Awaiting Analysis","description":"A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7},"cwes":["CWE-59"],"references":["https://access.redhat.com/errata/RHSA-2026:27903","https://access.redhat.com/errata/RHSA-2026:27913","https://access.redhat.com/errata/RHSA-2026:27914","https://access.redhat.com/errata/RHSA-2026:27983","https://access.redhat.com/errata/RHSA-2026:28002"],"products":[],"source":"nvd","synced_at":"2026-10-26T11:33:08.859761529+00:00"},"epss":{"cve":"CVE-2026-9804","score":0.00516,"percentile":0.43658,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-mpmf-3w4r-qfpf","url":"https://osv.dev/vulnerability/GHSA-mpmf-3w4r-qfpf","summary":"KubeVirt has a Link Following issue","modified":"2026-09-10T03:51:06.490591519Z","packages":[{"ecosystem":"Go","name":"kubevirt.io/kubevirt","purl":"pkg:golang/kubevirt.io/kubevirt","ranges":["<=1.9.0-beta.0"],"fixed":[]}]},{"id":"GO-2026-5883","url":"https://osv.dev/vulnerability/GO-2026-5883","summary":"KubeVirt has a Link Following issue in kubevirt.io/kubevirt","modified":"2026-07-07T16:00:30.360203844Z","packages":[{"ecosystem":"Go","name":"kubevirt.io/kubevirt","purl":"pkg:golang/kubevirt.io/kubevirt","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}