{"action":"Upgrade github.com/kubernetes-csi/csi-driver-nfs to 0.0.0-20260210055231-316af2d86b91 or later.","affected":[{"introduced":"0"}],"component":"github.com/kubernetes-csi/csi-driver-nfs","cve_ids":["CVE-2026-3864"],"ecosystem":"Go","epss":0.00731,"exploited":false,"fixed_versions":["0.0.0-20260210055231-316af2d86b91"],"ghsa_id":"GHSA-2mjq-54qg-7w6j","id":"tcs_01M5KGG9ACSQ6Y6CPDBFXJG0WB","modified_at":"2026-03-26T21:03:36.263065Z","published_at":"2026-03-26T20:33:02Z","references":["https://osv.dev/vulnerability/GO-2026-4816","https://github.com/advisories/GHSA-2mjq-54qg-7w6j","https://nvd.nist.gov/vuln/detail/CVE-2026-3864","https://github.com/kubernetes-csi/csi-driver-nfs/commit/316af2d86b913a595542dc17e8599cf81afd938f","http://www.openwall.com/lists/oss-security/2026/03/17/1","https://github.com/kubernetes/kubernetes/issues/137797","https://groups.google.com/g/kubernetes-security-announce/c/i4ZKN9VLcUE"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GO-2026-4816","url":"https://osv.dev/vulnerability/GO-2026-4816"},{"source":"nvd","source_id":"CVE-2026-3864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3864"}],"summary":"NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter in github.com/kubernetes-csi/csi-driver-nfs"}