7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9804

CVE-2026-9804: Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9804

CVE-2026-9804:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kubevirt.io/kubevirt	go	<= 1.9.0-beta.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the virt-exportserver component of KubeVirt, which is responsible for exporting virtual machine disks. The analysis of the patch commit 6ea563fa94d8ca803f8dd9394cefd8cae36bb0ee reveals that the dirHandler function in pkg/storage/export/virt-exportserver/exportserver.go was using the standard http.Dir filesystem implementation. This implementation is insecure by default as it follows symbolic links, creating a path traversal vulnerability. An attacker with sufficient permissions to create a symbolic link within an exported Persistent Volume Claim (PVC) could point this link to any file on the virt-exportserver pod's filesystem. When the dirHandler served a request for this symlink, it would disclose the contents of the targeted file. The patch replaces the insecure http.Dir with a custom symlinkSafeDir implementation that properly resolves paths and prevents symlinks from escaping the root directory, thus mitigating the vulnerability.

Vulnerable functions

dirHandler

pkg/storage/export/virt-exportserver/exportserver.go

The `dirHandler` function was responsible for serving files from a specified directory (`mountPoint`). It used `http.FileServer(http.Dir(mountPoint))`, which is known to follow symbolic links. An attacker with write access to the exported volume could create a symbolic link pointing to a sensitive file outside of the intended directory (e.g., `/etc/passwd` on the pod's filesystem). When a request was made to access this symbolic link, the `dirHandler` would follow it and serve the content of the linked file, leading to an arbitrary file read vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.