CVE-2026-9804

Descripción

A flaw was found in KubeVirt-s virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod-s filesystem. This leads to information disclosure, potentially exposing sensitive data.