Executive brief
K3s is a lightweight Kubernetes distribution used to manage containerized applications. A security flaw in how it handles backup files (etcd snapshots) allows a malicious archive to write files to unintended locations on the server's disk. If an administrator restores a compromised snapshot, it could lead to the corruption of system files or unauthorized configuration changes.
Technical details
A path traversal vulnerability (CWE-22) exists in the etcd snapshot decompression logic of K3s. The root cause is the improper validation of filenames within ZIP archives during the restoration process. An attacker with the ability to provide a malicious ZIP archive to an administrator can use '..' sequences in filenames to write files to arbitrary locations on the host filesystem. Exploitation requires an administrator to initiate a cluster reset or restore using the crafted snapshot. Patches are available in versions 1.35.3, 1.34.6, and 1.33.10.
Affected products
- k3s-io K3s >= 1.35.0-rc1, < 1.35.3; >= 1.34.0-rc1, < 1.34.6; < 1.33.10
Timeline
- 2026-06-03: disclosed: Initial disclosure to k3s-io/k3s
- 2026-06-25: advisory: NVD publication date
- 2026-07-14: advisory: GitHub Advisory Database publication date