CVE-2026-57966— Spice-vdagent: path traversal in file transfer via unsanitized filename
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SPICE spice-vdagent是SPICE组织的一款用于SPICE虚拟化环境中实现客户端与虚拟机之间剪贴板、分辨率与会话协同的代理工具。 spice-vdagent存在路径遍历漏洞，该漏洞源于对SPICE主机提供的文件名未进行正确清理，可能导致恶意或受损的SPICE主机向客户操作系统任意位置写入文件。
Affected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57966
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spice-vdagent: path traversal in file transfer via unsanitized filename
Source: CVE Program / CVE List V5
Vulnerability Description
A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
spice-vdagent 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SPICE spice-vdagent是SPICE组织的一款用于SPICE虚拟化环境中实现客户端与虚拟机之间剪贴板、分辨率与会话协同的代理工具。 spice-vdagent存在路径遍历漏洞，该漏洞源于对SPICE主机提供的文件名未进行正确清理，可能导致恶意或受损的SPICE主机向客户操作系统任意位置写入文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-57966
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57966
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-57966 (2)
-
-
🔗 2493582 – (CVE-2026-57966) CVE-2026-57966 spice-vdagent: Path traversal in file transfer via unsanitized filename Read full article issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-06-29 · 7 CVEs total
| CVE-2026-12856 | 8.8 HIGH | Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the |
| CVE-2026-12912 | 7.3 HIGH | Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image |
| CVE-2026-13601 | 7.1 HIGH | Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclos |
| CVE-2026-13595 | 6.8 MEDIUM | Util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| CVE-2026-13757 | 6.2 MEDIUM | P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing |
| CVE-2026-57965 | 5.1 MEDIUM | Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-103641
Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr u -
CVE-2026-103399
Libsoup: soupserver: http/1 request smuggling via undrained -
CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mi -
CVE-2026-102560
Libsoup: libsoup: heap buffer overflow during outgoing perme -
CVE-2026-102559
Libsoup: libsoup: heap buffer overflow during websocket clie
Same vendor: Red Hat
-
CVE-2026-103641
Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr u -
CVE-2026-103399
Libsoup: soupserver: http/1 request smuggling via undrained -
CVE-2026-101295
Oc-mirror: oc-mirror: path traversal / arbitrary file write -
CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mi -
CVE-2026-62146
Cri-o: cri-o: sandbox state poisoning via pod annotations ma
Same weakness: CWE-22
-
CVE-2025-41753
Path traversal in dynamically created BACnet File Objects -
CVE-2026-103533
David-Crty databasement database-servers API Endpoint Restor -
CVE-2023-54403
Yonyou U8 CRM Arbitrary File Read via getemaildata.php -
CVE-2024-58387
Inspur HCM Cloud Arbitrary File Read via file/download Endpo -
CVE-2026-102116
Kiteworks Email Protection Gateway Path Traversal
V. Comments for CVE-2026-57966
No comments yet