CVE-2026-107935 in Certification Program for Enterprise Linux 9
Summary
by MITRE • 10/09/2026
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within gvproxy, a critical network forwarder component of the gvisor-tap-vsock package, represents a severe security flaw rooted in improper input validation and insufficient access control mechanisms. Specifically, the unauthenticated endpoint /services/forwarder/expose fails to sanitize or validate user-supplied socket paths before processing them. This lack of rigorous checks allows an attacker who can reach this network service to manipulate file system operations on the host machine where gvproxy is executing. The core technical flaw lies in the absence of path canonicalization and boundary enforcement, which are standard defensive programming practices intended to prevent directory traversal attacks. By accepting arbitrary strings as socket paths without verifying that they reside within an expected or restricted directory structure, the application inadvertently exposes sensitive system resources to external manipulation.
From a technical perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The attacker can exploit this by supplying maliciously crafted input that includes relative or absolute paths pointing outside the intended scope, such as ../../etc/passwd or similar constructs depending on the operating system context. Because the endpoint is unauthenticated, there are no identity-based barriers preventing an adversary from initiating these requests. This significantly lowers the barrier to entry for exploitation, allowing any network-accessible entity with knowledge of the API structure to attempt file deletion operations against the host filesystem. The severity is compounded by the fact that gvproxy typically runs with elevated privileges necessary to manage virtual networking interfaces and socket bindings, thereby amplifying the potential impact of successful exploitation.
The operational impact of this vulnerability is substantial, as it enables an attacker to perform arbitrary file deletions on the underlying host system. This capability can lead to service disruption by removing critical configuration files, binaries, or logs essential for the operation of virtual machines and network services managed by gVisor. In more severe scenarios, if specific high-value targets are deleted, such as SSH keys, certificate authorities, or database files, it could result in a complete compromise of system integrity and availability. Furthermore, depending on how gvproxy interacts with other components of the container runtime environment, this file deletion might serve as an initial vector for further attacks, including privilege escalation or lateral movement within the host network. The ability to delete arbitrary files effectively constitutes a denial-of-service condition and potentially undermines data confidentiality if sensitive information is stored in deletable locations that are subsequently recreated with malicious content by other processes.
This behavior also maps directly to MITRE ATT&CK technique T1070: Indicator Removal, specifically the sub-technique of file deletion used to cover tracks or disrupt operations. Additionally, it relates to T1496: Resource Hijacking if the disruption leads to resource exhaustion during recovery efforts. The lack of authentication on this endpoint suggests a broader architectural issue where internal services are exposed without adequate network segmentation or access control lists, violating the principle of least privilege and zero trust security models recommended for containerized environments.
To mitigate this vulnerability, immediate remediation should focus on implementing strict input validation for all socket path parameters supplied to the /services/forwarder/expose endpoint. Developers must enforce canonicalization of file paths and ensure that resolved paths remain within a predefined, secure directory boundary using allowlists rather than denylists. It is crucial to apply principle of least privilege by running gvproxy with minimal required permissions, avoiding root or high-privilege user contexts whenever possible. Network-level mitigations include restricting access to the gvproxy API endpoints via firewall rules or service mesh policies so that only authorized internal services can communicate with them. Additionally, implementing robust logging and monitoring for unusual file system activity can aid in early detection of exploitation attempts. Regular security audits and static code analysis focused on path handling functions are essential to prevent similar flaws from being introduced in future updates.