Kubernetes (kubectl): Double-symlink in tar output escapes the kubectl cp destination

Impact

Double-symlink in tar output escapes the kubectl cp destination

Who can reach it

Malicious image

What to do

Upgrade kubectl on operator and CI machines

References

Related entries

• Kubernetes (kubectl): kubectl does not neutralise ANSI escape sequences in outputCVE-2021-25743 · Kubernetes (kubectl)Low
• Kubernetes (kubectl): `kubectl cp` path traversal from a malicious container tar overwrites files on the operator'sCVE-2019-11246 · Kubernetes (kubectl)Medium
• Kubernetes (kubectl): Follow-up incomplete fix for the kubectl cp traversalCVE-2019-11249 · Kubernetes (kubectl)Medium
• CRI-O: Shipped OpenShift CRI-O builds regressed the CVE-2022-2995 fixCVE-2022-3466 · CRI-OMedium
• gVisor: Reference-counting bug in mount-point tracking panics the sandboxCVE-2023-7258 · gVisorMedium
• ingress-nginx: auth-secret file path traversal in the controllerCVE-2025-24513 · ingress-nginxMedium