CriticalCritical vulnerability

CVE-2026-107935 (CVSS 9.3)

NVD · officialPublished Oct 9, 2026Risk 50/100

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

Technical details

CVSS

9.3

AV:Adjacent NetworkAC:LowPR:NoneUI:NoneC:NoneI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source