{"id":"GHSA-jxr7-mqhw-9p98","revision":"6446943709bf48edb9ed58ab064ce961","records":[{"revision":"6446943709bf48edb9ed58ab064ce961","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-jxr7-mqhw-9p98","aliases":["CVE-2026-54250","GO-2026-5973"],"title":"K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression","description":"#### Summary\n\nA path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names (e.g., `../../../../etc/password`) can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot.\n\n#### Mitigations\n\n* Enable golang's built-in [insecure path protections](https://pkg.go.dev/archive/zip#NewReader) when restoring snapshots by setting the`GODEBUG` environment variable:\n    ```bash\n    GODEBUG=zipinsecurepath=0 k3s server --cluster-reset --cluster-reset-restore-path=/path/to/snapshot.zip\n    ```\n* Manually extract the snapshot from the zip archive before restoring it. If the snapshot to be restored does not end with `.zip`, the vulnerable extraction code will not be executed.\n\n#### Additional Notes\n\nAdministrators should be aware of the cautions noted in the \"Security\" section of the documentation on [Restoring Snapshots](https://docs.k3s.io/cli/etcd-snapshot#security).","state":0,"publishedAt":"2026-07-14T17:54:14+00:00","modifiedAt":"2026-09-10T03:50:52.5660367+00:00","affected":[{"ecosystem":"Go","name":"github.com/k3s-io/k3s","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.35.0-rc1"},{"kind":"fixed","version":"1.35.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/k3s-io/k3s","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.34.0-rc1"},{"kind":"fixed","version":"1.34.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/k3s-io/k3s","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.33.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98","https://nvd.nist.gov/vuln/detail/CVE-2026-54250","https://github.com/k3s-io/k3s"],"sourceUrl":"https://github.com/advisories/GHSA-jxr7-mqhw-9p98","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jxr7-mqhw-9p98","identifiers":["GHSA-jxr7-mqhw-9p98","CVE-2026-54250","GO-2026-5973"]},"retained":false,"historicalAffected":[]}],"coverage":[]}