CVE-2026-57966
published 2026-06-29CVE-2026-57966: A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on…
PriorityP425medium4.4CVSS 3.1
AVLACLPRHUINSUCNIHAN
EPSS
0.13%
2.7th percentile
A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| spice-space | spice-vdagent | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
spice-vdagent path traversal (Nessus ID 329313)
vuldb·2026-07-24·CVSS 4.4
CVE-2026-57966 [MEDIUM] spice-vdagent path traversal (Nessus ID 329313)
A vulnerability categorized as critical has been discovered in spice-vdagent. Affected by this issue is some unknown functionality. Such manipulation leads to path traversal.
This vulnerability is documented as CVE-2026-57966. The attack needs to be performed locally. There is not any exploit available.
GHSA
A path traversal vulnerability was found in spice-vdagent.
ghsa_unreviewed·2026-06-29
CVE-2026-57966 [MEDIUM] CWE-22 A path traversal vulnerability was found in spice-vdagent.
A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Red Hat
spice-vdagent: Path traversal in file transfer via unsanitized filename
vendor_redhat·2026-05-27·CVSS 4.4
CVE-2026-57966 [MEDIUM] CWE-22 spice-vdagent: Path traversal in file transfer via unsanitized filename
spice-vdagent: Path traversal in file transfer via unsanitized filename
A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Package: spice-vdagent (Red Hat Enterprise Linux 10) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise Linux 6) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise Linux
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename [fedora-all]
bugzilla·2026-06-29·CVSS 7.8
CVE-2026-57966 [HIGH] CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename [fedora-all]
CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A path traversal vulnerability was found in spice-vdagent. In src/vdagent/file-xfers.c, the filename received from the SPICE host in file transfer metadata is used directly in g_build_filename() without any sanitization (file-xfers.c:138-139, 190). The g_build_filename() function has documented behavior where if the second argument is an absolute path (starts with '/'), the first argument (save_dir) is silently discarded. Additionally, '..' components in relative paths
Bugzilla
CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename
bugzilla·2026-06-26·CVSS 7.8
CVE-2026-57966 [HIGH] CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename
CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename
A path traversal vulnerability was found in spice-vdagent. In src/vdagent/file-xfers.c, the filename received from the SPICE host in file transfer metadata is used directly in g_build_filename() without any sanitization (file-xfers.c:138-139, 190). The g_build_filename() function has documented behavior where if the second argument is an absolute path (starts with '/'), the first argument (save_dir) is silently discarded. Additionally, '..' components in relative paths are not stripped, enabling directory traversal.
This allows a malicious SPICE host to write arbitrary files at arbitrary paths on the guest filesystem, with the privileges of the spice-vdagent process (typically the logged-in user).
Not
2026-06-29
Published