# CVE-2025-64324: GO-2025-4110 - KubeVirt Vulnerable to Arbitrary Host File Read and Write in kubevirt.io/kubevirt

Source: https://junglewise.ai/threats/cve-2025-64324-kubevirt-vulnerable-to-arbitrary-host-file-read-and-write  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18  
License: CC BY 4.0 with a link back

CVE-2025-64324 · Severity: high · CVSS 7.7 · Published 2025-11-18

KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.

Technologies: [kubevirt.io/kubevirt (Go)](https://junglewise.ai/threats/technologies/kubevirt-io-kubevirt), [KubeVirt](https://junglewise.ai/threats/technologies/kubevirt). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [KubeVirt](https://junglewise.ai/threats/vendors/kubevirt).

## Quick answers

**Is CVE-2025-64324 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64324 being exploited in the wild.

**How severe is CVE-2025-64324?** High severity, with a CVSS score of 7.7, published 18 November 2025.

**Which products and versions are affected?** kubevirt.io/kubevirt (Go) SEMVER:introduced=0,fixed=1.6.1, SEMVER:introduced=0,fixed=1.6.1,introduced=1.6.2,fixed=1.7.0-rc.0.

**Is there a fix for CVE-2025-64324?** Yes. kubevirt.io/kubevirt (Go): upgrade to 1.6.1, 1.7.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-64324?** Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kubevirt.io/kubevirt (Go): upgrade to 1.6.1, 1.7.0-rc.0 or later

  ```sh
  go get kubevirt.io/kubevirt@v1.7.0-rc.0
  ```


## Affected products

- kubevirt.io/kubevirt (Go) SEMVER:introduced=0,fixed=1.6.1, SEMVER:introduced=0,fixed=1.6.1,introduced=1.6.2,fixed=1.7.0-rc.0
- KubeVirt

## Identifiers

- CVE-2025-64324
- GHSA-46xp-26xh-hpqh
- GO-2025-4110

## Related threats

- [KubeVirt improper input validation in network annotation generator](https://junglewise.ai/threats/cve-2026-13434-kubevirt-improper-input-validation-in-network-annotation)
- [KubeVirt authentication bypass in migration proxy when TLS is disabled](https://junglewise.ai/threats/cve-2026-13325-kubevirt-authentication-bypass-in-migration-proxy-when-tls-is)
- [KubeVirt unbounded memory allocation in virt-handler virtio-serial server](https://junglewise.ai/threats/cve-2026-13322-kubevirt-unbounded-memory-allocation-in-virt-handler-virtio)
- [KubeVirt SSRF in virt-api port-forward handler](https://junglewise.ai/threats/cve-2026-13318-kubevirt-ssrf-in-virt-api-port-forward-handler)
- [KubeVirt virt-handler symlink following in WriteToCachedFile](https://junglewise.ai/threats/cve-2026-13218-kubevirt-virt-handler-symlink-following-in-writetocachedfile)