DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54250: CVE-2026-54250: Path Traversal Vulnerability in K3s etcd Snapshot Decompression

#security #cve #cybersecurity

CVE-2026-54250: Path Traversal Vulnerability in K3s etcd Snapshot Decompression

Vulnerability ID: CVE-2026-54250
CVSS Score: 5.8
Published: 2026-07-14

CVE-2026-54250 is a path traversal vulnerability in K3s, a lightweight Kubernetes distribution. The flaw exists within the etcd snapshot decompression functionality, allowing administrative users to write arbitrary files to the host filesystem via a maliciously crafted ZIP archive. Due to the high privilege level of the K3s process, this can result in total host compromise.

TL;DR

A Zip Slip path traversal vulnerability in K3s allows administrative users with snapshot restore capabilities to write arbitrary files to the host filesystem, potentially leading to remote code execution and host takeover.

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Local (AV:L)
  • CVSS Score: 5.8 (Medium)
  • EPSS Score: 0.00122 (Percentile: 2.32%)
  • Exploit Status: Unproven/None
  • CISA KEV Status: Not Listed

Affected Systems

  • K3s Control-Plane Server Nodes
  • K3s: >= 1.35.0-rc1+k3s1 to < 1.35.3+k3s1 (Fixed in: 1.35.3+k3s1)
  • K3s: >= 1.34.0-rc1+k3s1 to < 1.34.6+k3s1 (Fixed in: 1.34.6+k3s1)
  • K3s: < v1.33.10+k3s1 (Fixed in: v1.33.10+k3s1)

Mitigation Strategies

  • Upgrade to patched versions of K3s
  • Enforce GODEBUG=zipinsecurepath=0 environment variable
  • Manually pre-extract the ZIP archive using hardened tools

Remediation Steps:

  1. Identify the current version of K3s running on control-plane nodes.
  2. Download and apply the updated K3s binary corresponding to the patched release (e.g., 1.35.3+k3s1, 1.34.6+k3s1, or v1.33.10+k3s1).
  3. If upgrading is delayed, prepend 'GODEBUG=zipinsecurepath=0' to restoration command invocations as an active workaround.
  4. Alternatively, extract snapshot archives manually and target the decompressed database file directly in restoration commands.

References

Read the full report for CVE-2026-54250 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)