CVE-2026-57966: Red Hat spice-vdagent path traversal in file transfer

CVE-2026-57966 · Severity: medium · CVSS 4.4 · Published 2026-06-29

A security flaw was found in spice-vdagent, a tool used to improve the user experience in virtual machines by enabling features like file transfers. A compromised or malicious host machine can exploit this to write files to any location on the virtual guest system. This could allow an attacker to overwrite sensitive user data or system configuration files, potentially leading to a full compromise of the virtual machine.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2026-57966 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57966 being exploited in the wild.
How severe is CVE-2026-57966?
Medium severity, with a CVSS score of 4.4, published 29 June 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 10 All versions; Red Hat Enterprise Linux 6 All versions; Red Hat Enterprise Linux 7 All versions; Red Hat Enterprise Linux 8 All versions; and 2 more.
Is there a fix for CVE-2026-57966?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57966 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-57966?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in spice-vdagent within the file transfer handling logic in 'src/vdagent/file-xfers.c'. The component fails to sanitize filenames provided by the SPICE host before passing them to 'g_build_filename()'. Because 'g_build_filename()' discards the base directory if the provided filename is an absolute path, or allows '..' components, a malicious host can bypass the intended save directory. An attacker with control over the SPICE host can write arbitrary files to the guest filesystem with the privileges of the 'spice-vdagent' process, which typically runs as the logged-in user. This vulnerability is distinct from previous command injection issues in the same component.

Affected products

  • Red Hat Red Hat Enterprise Linux 10 All versions
  • Red Hat Red Hat Enterprise Linux 6 All versions
  • Red Hat Red Hat Enterprise Linux 7 All versions
  • Red Hat Red Hat Enterprise Linux 8 All versions
  • Red Hat Red Hat Enterprise Linux 9 All versions
  • SPICE Project spice-vdagent All versions

Timeline

  • 2026-06-26: disclosed: Initial report in Red Hat Bugzilla
  • 2026-06-29: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.