VYPR

safepath

by Kubevirt

CVEs (1)

  • CVE-2026-13201HigJun 24, 2026
    risk 0.47cvss 7.3epss 0.00

    A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a…