CVE-2026-65092: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in NVIDIA OpenShell

NVIDIA OpenShell Sandbox for Linux contains a CWE-22 path traversal vulnerability that enables an attacker with low privileges to bypass Layer 7 REST network policy controls. This bypass could allow unauthorized access to restricted directories, potentially leading to disclosure of sensitive information and unauthorized modification of data. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). No known exploits are reported in the wild, and no official remediation or patch has been published by NVIDIA at this time.

The vulnerability can result in high-impact information disclosure and limited data tampering due to bypass of network policy restrictions. It does not affect availability. The attacker requires some level of privileges (PR:L) but no user interaction is needed. The scope is changed (S:C), indicating impact beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the NVIDIA OpenShell Sandbox environment to trusted users only and monitor for suspicious activity related to path traversal attempts.