Executive brief
KubeEdge's keadm installation tool contains a path traversal vulnerability in its archive extraction function that could allow attackers to write files outside the intended directory. During edge node installation or joining on Windows systems, a malicious tar.gz archive could be used to overwrite system files, configuration files, or executables, potentially leading to unauthorized system modification or remote code execution if the keadm process runs with elevated privileges.
Technical details
The vulnerability exists in the DecompressTarGz function, which extracts tar.gz archives without properly validating archive entry names. Archive entries containing parent-directory traversal components (..), Windows-style backslashes, absolute paths, or drive-prefixed paths can cause files to be written outside the intended extraction directory. The attack vector is network-adjacent or local, requiring the attacker to influence the contents of an archive processed by keadm (e.g., through a compromised download source). Successful exploitation allows arbitrary file write with the privileges of the keadm process, which on Windows could enable persistence and code execution. The fix involves path normalization, validation of entry names, and use of secure path joining to ensure extracted files remain within the destination directory. Patches are available for versions 1.23.1, 1.22.2, and 1.21.2.
Affected products
- KubeEdge keadm before 1.21.2, 1.22.x before 1.22.2, 1.23.x before 1.23.1
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Patches available for v1.23.1, v1.22.2, v1.21.2