CVE-2026-107174

MediumCVSS 6.4/10Last modified Oct 7, 2026

Description

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-61

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Red HatOpenShift Serverless—
Red HatOpenShift Serverless—
Red HatOpenShift Serverless—
Red HatOpenShift Source-to-Image (S2I)—
Red HatOpenShift Source-to-Image (S2I)—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat Web Terminal—

References

Timeline

Published
Oct 7, 2026
Last modified
Oct 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071755.3MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distrCVE-2026-1071766.8A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, anCVE-2026-1071775.9Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt CVE-2026-1071786.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printinCVE-2026-107184.6Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing CVE-2026-1071807.1On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication sCVE-2026-1071818.1Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to injeCVE-2026-1071838.1llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated rCVE-2026-1071868.6An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workCVE-2026-1071878.5A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentCVE-2026-1071889.6A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the filCVE-2026-107191.8Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writin