KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
## Description KubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory. The issue is particularly relevant to Windows edge nodes during the `keadm join` or installation process when `keadm` extracts downloaded component archives. ## Impact An attacker who can cause an affected `keadm` process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running `keadm`. On Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the `keadm` process, successful exploitation could lead to persistent system modification or code execution. Exploitation requires the attacker to influence the contents of an archive processed by `keadm`, such as through a compromised, replaced, or otherwise untrusted download source. ## Patches The extraction logic now: * resolves the destination directory to an absolute path; * rejects empty archive entry names; * normalizes Windows-style path separators before validation;
GHSA-9vm9-pqxx-x83v
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-9vm9-pqxx-x83v
github.com/kubeedge/kubeedge
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.21.2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
github.com/kubeedge/kubeedge
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.22.2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
github.com/kubeedge/kubeedge
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.23.1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "1.16.0"
},
{
"fixed": "1.21.2"
}
]
}
],
"package": {
"name": "github.com/kubeedge/kubeedge",
"purl": "pkg:golang/github.com/kubeedge/kubeedge",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9vm9-pqxx-x83v/GHSA-9vm9-pqxx-x83v.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "1.22.0"
},
{
"fixed": "1.22.2"
}
]
}
],
"package": {
"name": "github.com/kubeedge/kubeedge",
"purl": "pkg:golang/github.com/kubeedge/kubeedge",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9vm9-pqxx-x83v/GHSA-9vm9-pqxx-x83v.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "1.23.0"
},
{
"fixed": "1.23.1"
}
]
}
],
"package": {
"name": "github.com/kubeedge/kubeedge",
"purl": "pkg:golang/github.com/kubeedge/kubeedge",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9vm9-pqxx-x83v/GHSA-9vm9-pqxx-x83v.json"
}
}
]- Related CVEs
- CVE-2026-62369
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #63912 · Revision 1
- Added to Heist Feed
- Publisher date