What is CVE-2018-10928?

CVE-2018-10928 is a high-severity vulnerability in Gluster Glusterfs, classified under Improper Link Resolution Before File Access. CVSS score: 8.8/10. Published 2018-09-04.

How severe is CVE-2018-10928?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Gluster Glusterfs

CVE-2018-10928

A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.

Published 2018-09-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.027 (85.8th percentile), scored 2026-11-01.

Low probability of exploitation in the next 30 days, but still tracked. 86th percentile — 85.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.027 · newest: 0.027 · change: -0.000

Affected products

Gluster Glusterfs
Debian Linux — versions 8.0, 9.0
openSUSE Leap — versions 15.1
Red Hat Glusterfs
Red Hat Enterprise Linux — versions 6.0, 7.0
Red Hat Enterprise Linux Server — versions 6.0, 7.0
Red Hat Gluster Storage — versions 3.0
Red Hat Virtualization Host — versions 4.0

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access

References

bugzilla.redhat.com/show_bug.cgi (Patch, Third Party Advisory, Issue Tracking)
access.redhat.com/errata/RHSA-2018:2607 (vendor-advisory, Third Party Advisory)
lists.debian.org/debian-lts-announce/2018/09/msg00021.html (mailing-list, Mailing List, Third Party Advisory)
access.redhat.com/errata/RHSA-2018:2608 (vendor-advisory, Third Party Advisory)
access.redhat.com/errata/RHSA-2018:3470 (vendor-advisory, Third Party Advisory)
security.gentoo.org/glsa/201904-06 (vendor-advisory, Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html (vendor-advisory, Mailing List, Third Party Advisory)
lists.debian.org/debian-lts-announce/2021/11/msg00000.html (mailing-list, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2018-10928?: CVE-2018-10928 is a high-severity vulnerability in Gluster Glusterfs, classified under Improper Link Resolution Before File Access. CVSS score: 8.8/10. Published 2018-09-04.
How severe is CVE-2018-10928?: High severity. CVSS v3 base score is 8.8 out of 10.