CVE-2026-107174
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
OpenShift Serverless
- Vendor
- Red Hat
- Product
- OpenShift Serverless
- Platforms
- Unknown
- Default status
affected- Package
- openshift-serverless-1/kn-client-kn-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
OpenShift Serverless
- Vendor
- Red Hat
- Product
- OpenShift Serverless
- Platforms
- Unknown
- Default status
affected- Package
- openshift-serverless-1/kn-plugin-func-func-util-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
OpenShift Serverless
- Vendor
- Red Hat
- Product
- OpenShift Serverless
- Platforms
- Unknown
- Default status
affected- Package
- openshift-serverless-clients
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
OpenShift Source-to-Image (S2I)
- Vendor
- Red Hat
- Product
- OpenShift Source-to-Image (S2I)
- Platforms
- Unknown
- Default status
affected- Package
- source-to-image/source-to-image-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
OpenShift Source-to-Image (S2I)
- Vendor
- Red Hat
- Product
- OpenShift Source-to-Image (S2I)
- Platforms
- Unknown
- Default status
affected- Package
- source-to-image/source-to-image-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift Container Platform 4
- Vendor
- Red Hat
- Product
- Red Hat OpenShift Container Platform 4
- Platforms
- Unknown
- Default status
affected- Package
- openshift4/ose-docker-builder
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift Container Platform 4
- Vendor
- Red Hat
- Product
- Red Hat OpenShift Container Platform 4
- Platforms
- Unknown
- Default status
affected- Package
- openshift4/ose-docker-builder-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Web Terminal
- Vendor
- Red Hat
- Product
- Red Hat Web Terminal
- Platforms
- Unknown
- Default status
affected- Package
- web-terminal/web-terminal-tooling-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.