CVE-2026-57966

Name of the Vulnerable Software and Affected Versions spice-vdagent (affected versions not specified)

Description A path traversal flaw exists in spice-vdagent, where a path traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root folder. This issue occurs because the filename provided by the SPICE host during file transfers is not properly sanitized. Consequently, a malicious or compromised SPICE host can write arbitrary files to any location on the guest operating system using the privileges of the spice-vdagent process, which typically corresponds to the logged-in user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.