Skip to content
Heist/ feed
HighFix available

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

Type: advisorySource: OSV1 source record

## Description KubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory. The issue is particularly relevant to Windows edge nodes during the `keadm join` or installation process when `keadm` extracts downloaded component archives. ## Impact An attacker who can cause an affected `keadm` process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running `keadm`. On Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the `keadm` process, successful exploitation could lead to persistent system modification or code execution. Exploitation requires the attacker to influence the contents of an archive processed by `keadm`, such as through a compromised, replaced, or otherwise untrusted download source. ## Patches The extraction logic now: * resolves the destination directory to an absolute path; * rejects empty archive entry names; * normalizes Windows-style path separators before validation;

Announced Source revision 1
Original source ↗

GHSA-9vm9-pqxx-x83v

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-9vm9-pqxx-x83v

github.com/kubeedge/kubeedge

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.21.2

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

github.com/kubeedge/kubeedge

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
1.22.2

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

github.com/kubeedge/kubeedge

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
1.23.1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.16.0"
          },
          {
            "fixed": "1.21.2"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/kubeedge/kubeedge",
      "purl": "pkg:golang/github.com/kubeedge/kubeedge",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9vm9-pqxx-x83v/GHSA-9vm9-pqxx-x83v.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.22.0"
          },
          {
            "fixed": "1.22.2"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/kubeedge/kubeedge",
      "purl": "pkg:golang/github.com/kubeedge/kubeedge",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9vm9-pqxx-x83v/GHSA-9vm9-pqxx-x83v.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.23.0"
          },
          {
            "fixed": "1.23.1"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/kubeedge/kubeedge",
      "purl": "pkg:golang/github.com/kubeedge/kubeedge",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9vm9-pqxx-x83v/GHSA-9vm9-pqxx-x83v.json"
    }
  }
]
Related CVEs
CVE-2026-62369

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-62369 · High

kubeedge

Event
#63912 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement