{"id":"EUVD-2026-32748","revision":"c76067d7d10f46d5acd4e205b5e49b47","records":[{"revision":"c76067d7d10f46d5acd4e205b5e49b47","observedAt":"2026-11-05T14:43:18.3+00:00","statement":{"source":"euvd","id":"EUVD-2026-32748","aliases":["CVE-2026-9804","GHSA-mpmf-3w4r-qfpf"],"title":"A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an expor…","description":"A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7,"severity":null}],"references":["https://access.redhat.com/errata/RHSA-2026:27903","https://access.redhat.com/errata/RHSA-2026:27913","https://access.redhat.com/errata/RHSA-2026:27914","https://access.redhat.com/errata/RHSA-2026:27983","https://access.redhat.com/errata/RHSA-2026:28002","https://access.redhat.com/security/cve/CVE-2026-9804","https://bugzilla.redhat.com/show_bug.cgi?id=2482487"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32748","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 28, 2026, 8:15:39 AM","dateUpdated":"Sep 10, 2026, 12:05:05 PM"},"relatedAdvisories":[{"id":"RHSA-2026:27913","title":"Red Hat Security Advisory: OpenShift Virtualization v4.18 Images","vulnerabilityIds":["CVE-2026-9804"]},{"id":"RHSA-2026:28002","title":"Red Hat Security Advisory: OpenShift Virtualization v4.17 Images","vulnerabilityIds":["CVE-2026-9804"]},{"id":"openSUSE-SU-2026:11015-1","title":"kubevirt-container-disk-1.8.3-1.1 on GA media","vulnerabilityIds":["CVE-2026-33186","CVE-2026-9804"]},{"id":"openSUSE-SU-2026:11057-1","title":"kubevirt-1.8-container-disk-1.8.3-1.1 on GA media","vulnerabilityIds":["CVE-2021-43565","CVE-2023-26484","CVE-2023-44487","CVE-2024-33394","CVE-2025-22872","CVE-2025-64433","CVE-2025-64437","CVE-2026-33186","CVE-2026-9804"]},{"id":"msrc_CVE-2026-9804","title":"Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read","vulnerabilityIds":["CVE-2026-9804"]},{"id":"RHSA-2026:27983","title":"Red Hat Security Advisory: OpenShift Virtualization v4.20 Images","vulnerabilityIds":["CVE-2026-9804","CVE-2026-35469"]},{"id":"RHSA-2026:27903","title":"Red Hat Security Advisory: OpenShift Virtualization v4.21 Images","vulnerabilityIds":["CVE-2026-9804","CVE-2026-35469"]},{"id":"RHSA-2026:27914","title":"Red Hat Security Advisory: OpenShift Virtualization v4.19 Images","vulnerabilityIds":["CVE-2026-9804","CVE-2026-35469"]},{"id":"openSUSE-SU-2026:11091-1","title":"kubevirt1.8-container-disk-1.8.3-1.1 on GA media","vulnerabilityIds":["CVE-2021-43565","CVE-2023-26484","CVE-2023-44487","CVE-2024-33394","CVE-2025-22872","CVE-2025-64433","CVE-2025-64437","CVE-2026-33186","CVE-2026-9804"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-32748","identifiers":["EUVD-2026-32748","CVE-2026-9804","GHSA-mpmf-3w4r-qfpf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}