Description
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.
Published: 2026-10-07
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized file access and data disclosure due to symlink extraction
Action: Patch
AI Analysis

Impact

A flaw in source-to-image causes unpacking of archive files to allow symbolic links that point to absolute file paths to be extracted outside the intended directory. An attacker who supplies a malicious builder image can embed such links, bypassing the sandbox boundaries and potentially accessing or modifying files on the host system, thereby compromising confidentiality and integrity.

Affected Systems

The vulnerability affects Red Hat OpenShift Serverless, Red Hat OpenShift Source‑to‑Image (S2I), Red Hat OpenShift Container Platform 4, and Red Hat Web Terminal. No specific version information is provided, indicating that all supported releases of these products are potentially impacted.

Risk and Exploitability

The CVSS score of 6.4 signifies a moderate severity rating. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting lower exploitation prevalence. The attack vector requires an attacker to control the builder image or the source code fed into the build process; it is not exploitable via remote network access alone. The risk is therefore conditioned on the care taken during build configuration and image selection, which can be mitigated by following the recommended controls.

Generated by OpenCVE AI on October 7, 2026 at 15:21 UTC.

Remediation

Vendor Workaround

Treat s2i builder images and application source as trusted inputs. Do not run s2i-based builds against builder images or repositories you do not control or have not verified. Where possible, run builds on isolated build nodes and restrict who can trigger builds or change BuildConfig and image stream references that point at custom builder images. There is no configuration option to disable only this symlink extraction behavior without changing how builds are performed. Apply updated source-to-image packages or rebuilt platform images when Red Hat publishes them for your product and stream.

OpenCVE Recommended Actions

  • Apply updated source‑to‑image packages or rebuilt platform images when Red Hat publishes them for your product and stream.
  • Treat S2I builder images and application source as trusted inputs; do not run S2I‑based builds against builder images or repositories you do not control or have not verified.
  • Run builds on isolated build nodes and restrict who can trigger builds or change BuildConfig and image stream references that point at custom builder images.

Generated by OpenCVE AI on October 7, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Redhat openshift Serverless
Redhat openshift Source-to-image
Vendors & Products Redhat openshift Container Platform
Redhat openshift Serverless
Redhat openshift Source-to-image

Thu, 08 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.
Title Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction
First Time appeared Redhat
Redhat openshift
Redhat serverless
Redhat source To Image
Redhat webterminal
Weaknesses CWE-61
CPEs cpe:/a:redhat:openshift:4
cpe:/a:redhat:serverless:1
cpe:/a:redhat:source_to_image:1
cpe:/a:redhat:webterminal:1
Vendors & Products Redhat
Redhat openshift
Redhat serverless
Redhat source To Image
Redhat webterminal
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Redhat Openshift Openshift Container Platform Openshift Serverless Openshift Source-to-image Serverless Source To Image Webterminal
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-07T16:17:28.174Z

Reserved: 2026-10-07T12:26:30.460Z

Link: CVE-2026-107174

cve-icon Vulnrichment

Updated: 2026-10-07T16:17:21.329Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-07T15:17:19.190

Modified: 2026-10-07T17:16:53.380

Link: CVE-2026-107174

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-07T12:58:45Z

Links: CVE-2026-107174 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T22:50:49Z

Weaknesses
  • CWE-61

    UNIX Symbolic Link (Symlink) Following