CVE-2026-57966
published 2026-06-29CVE-2026-57966: A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on…
PriorityP425medium4.4CVSS 3.1
AVLACLPRHUINSUCNIHAN
EPSS
0.13%
2.3th percentile
A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| spice-space | spice-vdagent | — | — |
| ubuntu | spice-vdagent | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
vendor_ubuntu5.1MEDIUM
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
spice-vdagent path traversal (Nessus ID 329313)
vuldb·2026-07-24·CVSS 4.4
CVE-2026-57966 [MEDIUM] spice-vdagent path traversal (Nessus ID 329313)
A vulnerability categorized as critical has been discovered in spice-vdagent. Affected by this issue is some unknown functionality. Such manipulation leads to path traversal.
This vulnerability is documented as CVE-2026-57966. The attack needs to be performed locally. There is not any exploit available.
GHSA
A path traversal vulnerability was found in spice-vdagent.
ghsa_unreviewed·2026-06-29
CVE-2026-57966 [MEDIUM] CWE-22 A path traversal vulnerability was found in spice-vdagent.
A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Ubuntu
SPICE vdagent vulnerabilities
vendor_ubuntu·2026-09-03·CVSS 5.1
CVE-2026-57965 [MEDIUM] SPICE vdagent vulnerabilities
Title: SPICE vdagent vulnerabilities
Summary: Several security issues were fixed in SPICE vdagent.
It was discovered that SPICE vdagent had an integer overflow in the buffer
size calculation used when writing to the daemon socket. A malicious or
compromised SPICE host could possibly use this issue to cause SPICE vdagent
to crash, resulting in a denial of service. (CVE-2026-57965)
It was discovered that SPICE vdagent did not properly sanitize filenames
provided by the SPICE host during file transfers. A malicious or
compromised SPICE host could possibly use this issue to write arbitrary
files to any location on the guest operating system with the privileges of
the spice-vdagent process. (CVE-2026-57966)
Instructions: After a standard system update you need to restart spice-vdagent to ma
Red Hat
spice-vdagent: Path traversal in file transfer via unsanitized filename
vendor_redhat·2026-05-27·CVSS 4.4
CVE-2026-57966 [MEDIUM] CWE-22 spice-vdagent: Path traversal in file transfer via unsanitized filename
spice-vdagent: Path traversal in file transfer via unsanitized filename
A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Package: spice-vdagent (Red Hat Enterprise Linux 10) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise Linux 6) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise Linux
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename [fedora-all]
bugzilla·2026-06-29·CVSS 7.8
CVE-2026-57966 [HIGH] CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename [fedora-all]
CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A path traversal vulnerability was found in spice-vdagent. In src/vdagent/file-xfers.c, the filename received from the SPICE host in file transfer metadata is used directly in g_build_filename() without any sanitization (file-xfers.c:138-139, 190). The g_build_filename() function has documented behavior where if the second argument is an absolute path (starts with '/'), the first argument (save_dir) is silently discarded. Additionally, '..' components in relative paths
Bugzilla
CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename
bugzilla·2026-06-26·CVSS 7.8
CVE-2026-57966 [HIGH] CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename
CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename
A path traversal vulnerability was found in spice-vdagent. In src/vdagent/file-xfers.c, the filename received from the SPICE host in file transfer metadata is used directly in g_build_filename() without any sanitization (file-xfers.c:138-139, 190). The g_build_filename() function has documented behavior where if the second argument is an absolute path (starts with '/'), the first argument (save_dir) is silently discarded. Additionally, '..' components in relative paths are not stripped, enabling directory traversal.
This allows a malicious SPICE host to write arbitrary files at arbitrary paths on the guest filesystem, with the privileges of the spice-vdagent process (typically the logged-in user).
Not
2026-06-29
Published