TI-2026-39152 Aliases CVE-2026-54250 GHSA-jxr7-mqhw-9p98

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

LOW 25CWE-22Published 2026-06-25 · Updated 2026-06-26

Key facts

Attack vector: Local
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00167 6th percentileScored 2026-11-07

Fix Fixed k3s (k3s-io): 1.35.3+k3s1, 1.34.6+k3s1, 1.33.10+k3s1github.com/k3s-io/k3s (Go): 1.35.3, 1.34.6, 1.33.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
k3s-io	k3s	1.35.0-rc1+k3s1 to before 1.35.3+k3s1; 1.34.0-rc1+k3s1 to before 1.34.6+k3s1; before 1.33.10+k3s1	1.35.3+k3s1, 1.34.6+k3s1, 1.33.10+k3s1	Patch available	CNA
—	github.com/k3s-io/k3s (Go)	1.35.0-rc1 to before 1.35.3	1.35.3	Patch available	GHSA-jxr7-mqhw-9p98
—	github.com/k3s-io/k3s (Go)	1.34.0-rc1 to before 1.34.6	1.34.6	Patch available	GHSA-jxr7-mqhw-9p98
—	github.com/k3s-io/k3s (Go)	before 1.33.10	1.33.10	Patch available	GHSA-jxr7-mqhw-9p98

k3s Vendork3s-io Affected 1.35.0-rc1+k3s1 to before 1.35.3+k3s1; 1.34.0-rc1+k3s1 to before 1.34.6+k3s1; before 1.33.10+k3s1 Fixed in 1.35.3+k3s1, 1.34.6+k3s1, 1.33.10+k3s1 Patch available CNA
github.com/k3s-io/k3s (Go) Vendor— Affected 1.35.0-rc1 to before 1.35.3 Fixed in 1.35.3 Patch available GHSA-jxr7-mqhw-9p98
github.com/k3s-io/k3s (Go) Vendor— Affected 1.34.0-rc1 to before 1.34.6 Fixed in 1.34.6 Patch available GHSA-jxr7-mqhw-9p98
github.com/k3s-io/k3s (Go) Vendor— Affected before 1.33.10 Fixed in 1.33.10 Patch available GHSA-jxr7-mqhw-9p98

Remediation

Fix · CNA k3s (k3s-io) Fixed in 1.35.3+k3s1, 1.34.6+k3s1, 1.33.10+k3s1
Fix · GHSA-jxr7-mqhw-9p98 github.com/k3s-io/k3s (Go) Fixed in 1.35.3 Advisory →
Fix · GHSA-jxr7-mqhw-9p98 github.com/k3s-io/k3s (Go) Fixed in 1.34.6 Advisory →
Fix · GHSA-jxr7-mqhw-9p98 github.com/k3s-io/k3s (Go) Fixed in 1.33.10 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-54250
2026-10-03 Alias added: GHSA-jxr7-mqhw-9p98

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-54250

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences