VULNERABILITY INTELLIGENCE

CVE-2022-1798

CVSS score8.7 HIGH

EPSS probability0.38%

CISA KEVNot currently listed

Published2022-09-15

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H

Description

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

Weakness classification

CWE-20: Improper Input Validation
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

cve-coordination@google.com — Exploit, Mitigation, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Patch, Third Party Advisory