Path Traversal Vulnerability in KubeEdge's DecompressTarGz Function
CVE-2026-62369
8.1HIGH
What is CVE-2026-62369?
KubeEdge contains a path traversal vulnerability in the DecompressTarGz function used in keadm that allows a maliciously crafted archive to lead to the unvalidated joining of files to the system. This occurs when an archive includes paths that escape the intended extraction directory, potentially leading to unauthorized file overwrites. This can result in unauthorized alterations to crucial files within the system, such as configuration settings or executables, allowing for persistent changes or code execution. Versions 1.21.2, 1.22.2, and 1.23.1 have addressed this flaw.
Affected Version(s)
kubeedge >= 1.16.0, < 1.21.2 < 1.16.0, 1.21.2
kubeedge >= 1.22.0, < 1.22.2 < 1.22.0, 1.22.2
kubeedge >= 1.23.0, < 1.23.1 < 1.23.0, 1.23.1