Vulnerability-Lookup

CVE-2026-62369 (GCVE-0-2026-62369)

Vulnerability from cvelistv5 – Published: 2026-09-21 17:10 – Updated: 2026-09-21 17:10

Title

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

Summary

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

13 references

URL	Tags
https://github.com/kubeedge/kubeedge/security/adv…	x_refsource_CONFIRM
https://github.com/kubeedge/kubeedge/pull/7028	x_refsource_MISC
https://github.com/kubeedge/kubeedge/pull/7029	x_refsource_MISC
https://github.com/kubeedge/kubeedge/pull/7030	x_refsource_MISC
https://github.com/kubeedge/kubeedge/commit/47767…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/commit/a524a…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/commit/ee02d…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/blob/master/…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/blob/master/…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/blob/master/…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/releases/tag…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/releases/tag…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
kubeedge	kubeedge	Affected: >= 1.16.0, < 1.21.2 Affected: >= 1.22.0, < 1.22.2 Affected: >= 1.23.0, < 1.23.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "kubeedge",
          "vendor": "kubeedge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.16.0, \u003c 1.21.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.22.0, \u003c 1.22.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.23.0, \u003c 1.23.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T17:10:57.979Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/pull/7028",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/pull/7028"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/pull/7029",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/pull/7029"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/pull/7030",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/pull/7030"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9vm9-pqxx-x83v",
        "discovery": "UNKNOWN"
      },
      "title": "KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62369",
    "datePublished": "2026-09-21T17:10:57.979Z",
    "dateReserved": "2026-07-13T22:04:59.678Z",
    "dateUpdated": "2026-09-21T17:10:57.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-62369",
      "date": "2026-09-23",
      "epss": "0.0062",
      "percentile": "0.48385"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "kubeedge",
                "vendor": "kubeedge",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.16.0, \u003c 1.21.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.22.0, \u003c 1.22.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.23.0, \u003c 1.23.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1."
          }
        ],
        "id": "CVE-2026-62369",
        "lastModified": "2026-09-21T18:17:09.580",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-21T18:17:09.580",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/pull/7028"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/pull/7029"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/pull/7030"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-62369

Vulnerability from fkie_nvd - Published: 2026-09-21 18:17 - Updated: 2026-09-21 18:17

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/pull/7028
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/pull/7029
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/pull/7030
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kubeedge",
          "vendor": "kubeedge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.16.0, \u003c 1.21.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.22.0, \u003c 1.22.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.23.0, \u003c 1.23.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1."
    }
  ],
  "id": "CVE-2026-62369",
  "lastModified": "2026-09-21T18:17:09.580",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-21T18:17:09.580",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/pull/7028"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/pull/7029"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/pull/7030"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-9VM9-PQXX-X83V

Vulnerability from github – Published: 2026-09-22 20:36 – Updated: 2026-09-22 20:36

Summary

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

Details

Description

KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function.

Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory.

The issue is particularly relevant to Windows edge nodes during the keadm join or installation process when keadm extracts downloaded component archives.

Impact

An attacker who can cause an affected keadm process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running keadm.

On Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the keadm process, successful exploitation could lead to persistent system modification or code execution.

Exploitation requires the attacker to influence the contents of an archive processed by keadm, such as through a compromised, replaced, or otherwise untrusted download source.

Patches

The extraction logic now:

resolves the destination directory to an absolute path;
rejects empty archive entry names;
normalizes Windows-style path separators before validation;
rejects parent-directory traversal paths;
rejects absolute and Windows drive-prefixed paths;
uses filepath-securejoin to ensure extracted files remain within the destination directory.

Fixes are planned for the following maintained releases:

v1.23.1
v1.22.2
v1.21.2

Workarounds

Until a patched release is available:

only install or join edge nodes using trusted KubeEdge package sources;
verify the integrity and origin of downloaded archives before extraction;
do not use custom or untrusted component archives with keadm;
restrict write permissions and administrative privileges for the account running keadm;
avoid performing Windows edge-node installation or join operations when the package source cannot be trusted.

Credits

KubeEdge thanks Sang-Hoon Choi (KoreaSecurity, Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubeedge/kubeedge"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.16.0"
            },
            {
              "fixed": "1.21.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubeedge/kubeedge"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.22.0"
            },
            {
              "fixed": "1.22.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubeedge/kubeedge"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.23.0"
            },
            {
              "fixed": "1.23.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62369"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:36:59Z",
    "nvd_published_at": "2026-09-21T18:17:09Z",
    "severity": "HIGH"
  },
  "details": "## Description\n\nKubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction function.\n\nArchive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory.\n\nThe issue is particularly relevant to Windows edge nodes during the `keadm join` or installation process when `keadm` extracts downloaded component archives.\n\n## Impact\n\nAn attacker who can cause an affected `keadm` process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running `keadm`.\n\nOn Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the `keadm` process, successful exploitation could lead to persistent system modification or code execution.\n\nExploitation requires the attacker to influence the contents of an archive processed by `keadm`, such as through a compromised, replaced, or otherwise untrusted download source.\n\n## Patches\n\nThe extraction logic now:\n\n* resolves the destination directory to an absolute path;\n* rejects empty archive entry names;\n* normalizes Windows-style path separators before validation;\n* rejects parent-directory traversal paths;\n* rejects absolute and Windows drive-prefixed paths;\n* uses `filepath-securejoin` to ensure extracted files remain within the destination directory.\n\nFixes are planned for the following maintained releases:\n\n* v1.23.1\n* v1.22.2\n* v1.21.2\n\n## Workarounds\n\nUntil a patched release is available:\n\n* only install or join edge nodes using trusted KubeEdge package sources;\n* verify the integrity and origin of downloaded archives before extraction;\n* do not use custom or untrusted component archives with `keadm`;\n* restrict write permissions and administrative privileges for the account running `keadm`;\n* avoid performing Windows edge-node installation or join operations when the package source cannot be trusted.\n\n## Credits\n\nKubeEdge thanks Sang-Hoon Choi ([KoreaSecurity](https://github.com/KoreaSecurity), Sejong University)\nfor responsibly reporting this issue and for coordinating with the KubeEdge\nmaintainers through the security disclosure process.",
  "id": "GHSA-9vm9-pqxx-x83v",
  "modified": "2026-09-22T20:36:59Z",
  "published": "2026-09-22T20:36:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62369"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/pull/7028"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/pull/7029"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/pull/7030"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kubeedge/kubeedge"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-62369 (GCVE-0-2026-62369)

FKIE_CVE-2026-62369

GHSA-9VM9-PQXX-X83V

Description

Impact

Patches

Workarounds

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour