CVE-2026-54250CWE-22

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Medium · published June 25, 2026

CVSS v3.1
5.8
EPSS
0%
Percentile
5.7
In the wild
Unconfirmed
What it is

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00167 · 5.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-25T17:56Z
EPSS history
Timeline
  • 25 JUN 17:56Z
    K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
    cvelistv5