What’s Vulnerable › Vulnerabilities
CVE-2026-54250: K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
- Severity: medium (CVSS 5.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-25 · updated 2026-10-25
- Weakness: CWE-22
Description
K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1.
Affected products
- k3s-io k3s: from 1.35.0-rc1+k3s1, < 1.35.3+k3s1; from 1.34.0-rc1+k3s1, < 1.34.6+k3s1; before 1.33.10+k3s1
References
Get alerted when CVE-2026-54250 or the next vulnerability affects your stack