A vulnerability in KubeVirt allows an attacker with control over a Persistent Volume Claim (PVC) to create symbolic links that enable reading arbitrary files from the virt-launcher pod's file system. This occurs due to improper symlink handling when mounting PVC disks into a VM, combined with a secondary vulnerability that changes file ownership to an unprivileged user, bypassing intended access restrictions. The flaw affects KubeVirt versions prior to 1.5.3 and between 1.6.0-alpha.0 and before 1.6.1. A fix is available in versions 1.5.3 and 1.6.1.