CVE-2026-107174
Awaiting Analysis Awaiting Analysis - Queue

Source-to-Image Symlink Path Traversal Vulnerability

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: redhat-SADP

Description
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107174
EUVD
EUVD-2026-94367

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
redhat source-to-image *
red_hat source-to-image From 4.12 (inc) to 4.22 (inc)
red_hat openshift_container_platform From 4.12 (inc) to 4.22 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the source-to-image (s2i) tool used for building container images. When extracting tar archives in restricted mode, s2i checks if symbolic links point outside the extraction directory but fails to properly validate absolute path targets. The tool creates symlinks using unvalidated raw paths from the archive, allowing attackers to bypass sandbox boundaries by embedding links to arbitrary host system files.

Detection Guidance

To detect this vulnerability, inspect s2i builder images and build processes for suspicious symlinks. Check for absolute path symlinks in extracted archives by examining tar contents before extraction. Use commands like tar -tvf archive.tar to list symlinks and grep for absolute paths. Monitor build logs for unexpected file operations outside intended directories.

Impact Analysis

An attacker could exploit this to create symlinks pointing to sensitive system files like /etc/passwd or /etc/shadow. This may lead to unauthorized information disclosure by reading protected files or file modification by overwriting critical system configurations. The impact is limited to the build host environment where s2i operates.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected s2i versions may fail compliance audits if they cannot demonstrate adequate protection against such symlink attacks during container builds.

Mitigation Strategies

Only use trusted builder images and application sources. Avoid untrusted builds and run builds on isolated nodes. Restrict build triggers to prevent exploitation. Monitor for unauthorized file access or modifications during builds. Apply updates once available from Red Hat.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107174. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart