Cloudanix VulnDB

CVE-2025-64433

Medium · 6.5

KubeVirt Arbitrary Container File Read

CVSS

6.5

EPSS

0.5%

Published

Nov 6, 2025

CISA due date

—

The record

_Short summary of the problem. Make the impact and severity as clear as possible. Mounting a user-controlled PVC disk within a VM allows an attacker to read any file present in the `virt-launcher` pod. This is due to erroneous handling of symlinks defined within a PVC.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/kubevirt/kubevirt 0 1.5.3
Go github.com/kubevirt/kubevirt 1.6.0-alpha.0 1.6.0-beta.0.0.20250801195231-a81b27d4600c
Go github.com/kubevirt/kubevirt 1.6.0-rc.0 1.6.1
Go kubevirt.io/kubevirt 0 1.5.3
Go kubevirt.io/kubevirt 1.6.0-alpha.0 1.6.1
Chainguard docker-machine-driver-harvester 0 1.0.6-r4
Wolfi docker-machine-driver-harvester 0 1.0.6-r4
go github.com/kubevirt/kubevirt 1.6.0-rc.0 1.6.1
go kubevirt.io/kubevirt 1.6.0-alpha.0 1.6.1
openSUSE:Leap 16.0 kubevirt 0 1.7.0-160000.1.1
openSUSE:Tumbleweed kubevirt 0 1.6.3-1.1
openSUSE:Tumbleweed kubevirt-1.8 0 1.8.3-1.1
openSUSE:Tumbleweed kubevirt1.8 0 1.8.3-1.1

Related vulnerabilities