EUVD-2026-62192Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network vector reflects OCI image distribution; PR:L for workload owner role; S:C captures pod VM boundary crossing; C:L/I:L for limited VM file access and attestation integrity risk; no availability impact confirmed.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make image_rs::stream::unpack::unpack() create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs, try_hardlink_fallback() validates the hardlink source but computes the destination with destination.join(&entry_rel). Rust Path::join replaces the base when entry_rel is an absolute tar entry path, so fs::hard_link(&src_canon, &dst_entry_abs) can write attacker-controlled content to an arbitrary absolute path. In Confidential Containers the workload owner already controls trusted image content, so the issue is a workload-owner escape into the pod virtual machine rather than a crossing of the image trust boundary, but it may enable access to pod virtual machine capabilities and attestation abuse. This issue is fixed in version 0.20.0.
AnalysisAI
Path traversal in Confidential Containers guest-components (image-rs) versions 0.16.0 through 0.19.x allows a workload owner to create hardlinks outside the OCI layer destination directory and into arbitrary absolute paths within the pod virtual machine. The root cause is Rust's standard library behavior where Path::join() silently discards the base path when the right-hand operand is absolute, allowing a crafted tar entry to bypass directory confinement in try_hardlink_fallback(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold the workload owner role - specifically, the ability to publish or control the OCI image content that a Confidential Containers workload will pull and unpack using the affected guest-components versions 0.16.0 through 0.19.x. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N is broadly consistent with the vulnerability mechanics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to guest-components v0.20.0, which resolves the vulnerability by replacing the unsafe `destination.join()` path computation with `pathrs::Root`-scoped operations that enforce directory confinement for all hardlink creation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today