---
id: CVE-2026-57966
title: 'Spice-vdagent: path traversal in file transfer via unsanitized filename'
summary: >-
  A path traversal vulnerability was found in spice-vdagent. This flaw allows a
  malicious or compromised SPICE host to write arbitrary files to any location
  on the guest operating system. This occurs because the filename provided by
  the SP…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: Red Hat
product: spice-vdagent
affected:
  - spice-vdagent (all versions)
  - spice-vdagent (all versions)
  - spice-vdagent (all versions)
  - mingw-spice-vdagent (all versions)
  - spice-vdagent (all versions)
  - spice-vdagent (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-29T12:53:14.671684Z'
published: '2026-06-29'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:16:58.348Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57966'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-57966'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2493582'
    label: RHBZ#2493582
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02336
ingestedAt: '2026-11-05T23:41:31.949Z'
---

## Overview

A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.

## Affected

- `spice-vdagent (all versions)`
- `spice-vdagent (all versions)`
- `spice-vdagent (all versions)`
- `mingw-spice-vdagent (all versions)`
- `spice-vdagent (all versions)`
- `spice-vdagent (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.