CVE-2026-54250: K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

July 14, 2026

A path traversal vulnerability exists in K3s’s etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names (e.g., ../../../../etc/password) can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot.

References

github.com/advisories/GHSA-jxr7-mqhw-9p98
github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98
nvd.nist.gov/vuln/detail/CVE-2026-54250

Code Behaviors & Features

Detect and mitigate CVE-2026-54250 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →