CVE-2026-107935

Summary

A path traversal vulnerability in gvproxy allows unauthenticated attackers to delete arbitrary files on the host system through the /services/forwarder/expose endpoint. This occurs because the service fails to validate socket paths provided by callers, enabling attackers to craft malicious paths that traverse outside the intended directory structure.

Exploitability

Exploitation is straightforward with no authentication required, needing only access to the vulnerable endpoint on a system running gvproxy, typically in containerized environments where gvisor-tap-vsock is used for networking.

Blast radius

The impact could be severe in containerized environments where gvproxy runs with elevated privileges, potentially allowing attackers to delete critical system files, configuration data, or container runtime artifacts that could lead to service disruption or complete system compromise.

Detection

Monitor for unusual DELETE requests to paths that traverse outside typical application directories in the gvproxy process logs, particularly when these requests originate from the /services/forwarder/expose endpoint.

Prioritized remediation

Upgrade to gvisor-tap-vsock version 2.590 or later which contains the fix for this path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.