Hi,

The following vulnerability was published for spice-vdagent.

CVE-2026-57966[0]:
| A path traversal vulnerability was found in spice-vdagent. This flaw
| allows a malicious or compromised SPICE host to write arbitrary
| files to any location on the guest operating system. This occurs
| because the filename provided by the SPICE host during file
| transfers is not properly sanitized before being used. An attacker
| could exploit this to write to sensitive locations with the
| privileges of the spice-vdagent process, typically the logged-in
| user. This issue requires the SPICE host to be untrusted or
| compromised for exploitation.

https://bugzilla.redhat.com/show_bug.cgi?id=2493582


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-57966
https://www.cve.org/CVERecord?id=CVE-2026-57966

Please adjust the affected versions in the BTS as needed.

fixed 1141318 0.23.0-3
fixed 1141317 0.23.0-3
thanks


I've prepared an update and uploaded to archive fixing CVE-2026-57965
and CVE-2026-57966 but missed to tag bug number in d/changelog.