GHSA-JXR7-MQHW-9P98中危已审查

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

OSV 1.4.0 · github-reviewed · 修改于 2026-07-15 01:54

发布时间

2026-07-15 01:54

GitHub 审查时间

2026-07-15 01:54

NVD 发布时间

2026-06-26 03:16

源文件

advisories/github-reviewed/2026/07/GHSA-jxr7-mqhw-9p98/GHSA-jxr7-mqhw-9p98.json

公告说明

Summary

A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names (e.g., ../../../../etc/password) can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot.

Mitigations

Enable golang's built-in insecure path protections when restoring snapshots by setting theGODEBUG environment variable:
```
GODEBUG=zipinsecurepath=0 k3s server --cluster-reset --cluster-reset-restore-path=/path/to/snapshot.zip
```
Manually extract the snapshot from the zip archive before restoring it. If the snapshot to be restored does not end with .zip, the vulnerable extraction code will not be executed.

Additional Notes

Administrators should be aware of the cautions noted in the "Security" section of the documentation on Restoring Snapshots.

受影响的软件包

标识信息

别名 / CVE

CVE-2026-54250

CWE

CWE-22

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-jxr7-mqhw-9p98",
  "aliases": [
    "CVE-2026-54250"
  ],
  "details": "#### Summary\n\nA path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names (e.g., `../../../../etc/password`) can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot.\n\n#### Mitigations\n\n* Enable golang's built-in [insecure path protections](https://pkg.go.dev/archive/zip#NewReader) when restoring snapshots by setting the`GODEBUG` environment variable:\n    ```bash\n    GODEBUG=zipinsecurepath=0 k3s server --cluster-reset --cluster-reset-restore-path=/path/to/snapshot.zip\n    ```\n* Manually extract the snapshot from the zip archive before restoring it. If the snapshot to be restored does not end with `.zip`, the vulnerable extraction code will not be executed.\n\n#### Additional Notes\n\nAdministrators should be aware of the cautions noted in the \"Security\" section of the documentation on [Restoring Snapshots](https://docs.k3s.io/cli/etcd-snapshot#security).",
  "summary": "K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "1.35.0-rc1"
            },
            {
              "fixed": "1.35.3"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/k3s-io/k3s",
        "ecosystem": "Go"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "1.34.0-rc1"
            },
            {
              "fixed": "1.34.6"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/k3s-io/k3s",
        "ecosystem": "Go"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.33.10"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/k3s-io/k3s",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2026-07-14T17:54:14Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H"
    }
  ],
  "published": "2026-07-14T17:54:14Z",
  "references": [
    {
      "url": "https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54250",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/k3s-io/k3s",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2026-06-25T19:16:41Z",
    "github_reviewed_at": "2026-07-14T17:54:14Z"
  }
}