CVE-2026-107935: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Build of Podman Desktop

A path traversal vulnerability in the gvproxy network forwarder component of the gvisor-tap-vsock package used by Red Hat Build of Podman Desktop allows unauthenticated attackers to delete arbitrary files on the host system. The issue arises because the /services/forwarder/expose endpoint does not validate the caller-supplied socket path, enabling path traversal attacks. This vulnerability is tracked as CVE-2026-107935 and has a CVSS 3.1 base score of 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H).

An unauthenticated attacker can exploit this vulnerability remotely to delete arbitrary files on the host system, leading to high impact on integrity and availability. The vulnerability does not impact confidentiality but can cause denial of service or system disruption by removing critical files.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-107935 for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to the /services/forwarder/expose endpoint.