CVE-2026-13218CWE-61

Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher

Medium · published June 25, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
3.0
In the wild
Unconfirmed
What it is

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00139 · 3.0th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-06-25T23:23Z
EPSS history
Timeline
  • 25 JUN 23:23Z
    Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher
    cvelistv5