Threats tagged 'ghsa-q3jc-42cq-33fj'

CVE-2026-13218 is a vulnerability in KubeVirt's virt-handler network cache handling where the WriteToCachedFile function lacks symlink protection. This allows a user with access to the virt-launcher container to plant a symlink that causes virt-handler to overwrite arbitrary host files with JSON content and change ownership. Exploitation requires non-default network configuration (bridge-type binding), exec access to the virt-launcher container, and is constrained by SELinux policies and content format limitations. The vulnerability is rated medium severity with a CVSS score of 4.2.