CVE-2026-54250

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54250", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T16:25:43.085Z", "datePublished": "2026-06-25T17:56:56.747Z", "dateUpdated": "2026-06-26T18:42:33.835Z"}, "containers": {"cna": {"title": "K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98"}], "affected": [{"vendor": "k3s-io", "product": "k3s", "versions": [{"version": ">= 1.35.0-rc1+k3s1, < 1.35.3+k3s1", "status": "affected"}, {"version": ">= 1.34.0-rc1+k3s1, < 1.34.6+k3s1", "status": "affected"}, {"version": "< 1.33.10+k3s1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-25T17:56:56.747Z"}, "descriptions": [{"lang": "en", "value": "K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1."}], "source": {"advisory": "GHSA-jxr7-mqhw-9p98", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T17:50:42.464225Z", "id": "CVE-2026-54250", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T18:42:33.835Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54250", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T17:50:42.464225Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T17:50:43.600Z"}}], "cna": {"title": "K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression", "source": {"advisory": "GHSA-jxr7-mqhw-9p98", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "k3s-io", "product": "k3s", "versions": [{"status": "affected", "version": ">= 1.35.0-rc1+k3s1, < 1.35.3+k3s1"}, {"status": "affected", "version": ">= 1.34.0-rc1+k3s1, < 1.34.6+k3s1"}, {"status": "affected", "version": "< 1.33.10+k3s1"}]}], "references": [{"url": "https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98", "name": "https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-25T17:56:56.747Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54250", "state": "PUBLISHED", "dateUpdated": "2026-06-26T18:42:33.835Z", "dateReserved": "2026-06-12T16:25:43.085Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-25T17:56:56.747Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "k3s", "vendor": "k3s-io", "versions": [{"status": "affected", "version": ">= 1.35.0-rc1+k3s1, < 1.35.3+k3s1"}, {"status": "affected", "version": ">= 1.34.0-rc1+k3s1, < 1.34.6+k3s1"}, {"status": "affected", "version": "< 1.33.10+k3s1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1."}, {"lang": "es", "value": "K3s es una distribuci\u00f3n de Kubernetes totalmente conforme y lista para producci\u00f3n. Antes de 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, existe una vulnerabilidad de salto de ruta en la funcionalidad de descompresi\u00f3n de instant\u00e1neas de etcd de K3s. Los archivos Zip que contienen miembros de archivo con nombres creados maliciosamente pueden escribirse en ubicaciones arbitrarias del sistema de archivos cuando un administrador restaura el archivo como una instant\u00e1nea de etcd comprimida. Esta vulnerabilidad est\u00e1 corregida en 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1."}], "id": "CVE-2026-54250", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.6, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54250", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T17:50:42.464225Z", "version": "2.0.3"}}]}, "published": "2026-06-25T19:16:41.983", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.35.0-rc1+k3s1,1.35.3+k3s1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.34.0-rc1+k3s1,1.34.6+k3s1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.33.10+k3s1)"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "k3s", "source": "cna", "vendor": "k3s-io"}, "product": "k3s", "vendor": "k3s"}], "created": "2026-06-25T20:00:11.190336+00:00", "updated": "2026-06-26T07:15:16.847878+00:00", "vendors": ["k3s", "k3s$PRODUCT$k3s"]}