CVE-2026-107174
Last modified
CVE-2026-107174 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths.
Description
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | OpenShift Serverless | All versions |
| Red Hat | OpenShift Source-to-Image (S2I) | All versions |
| Red Hat | Red Hat OpenShift Container Platform 4 | All versions |
| Red Hat | Red Hat Web Terminal | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-107174?
How severe is CVE-2026-107174?
How do I fix CVE-2026-107174?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-107166A weakness has been identified in Open5GS up to 2.7.7. This …5.3
- CVE-2026-107167A flaw was found in m17n-lib. A user providing specially cra…6.2
- CVE-2026-107168A flaw was found in m17n-lib. By providing crafted input con…6.2
- CVE-2026-107169A flaw was found in m17n-lib. An attacker could provide spec…6.2
- CVE-2026-10717Out of bounds write and reads in openSeaChest’s --showSCSIDe…1.8
- CVE-2026-107170A flaw was found in m17n-lib. A partial failure during libra…2.9
- CVE-2026-107175MISP contains a defect in its event save workflow that preve…5.3
- CVE-2026-107177Express Gateway through 1.16.11 contains a hardcoded cryptog…5.9
- CVE-2026-10718Out of bounds write in openSeaChest’s Trim/Unmap operation i…4.6
- CVE-2026-107180On MISP instances configured to require TOTP enrolment (Secu…7.1
- CVE-2026-107181Telegram Desktop before 7.2.9 contains an IPC record-separat…8.1
- CVE-2026-107183llama.cpp before b11393 contains a use-after-free and double…8.1
Are you affected by CVE-2026-107174?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST