CVE-2026-54250

{
  "id": "CVE-2026-54250",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-25T19:16:41.983",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1."
    },
    {
      "lang": "es",
      "value": "K3s es una distribución de Kubernetes totalmente conforme y lista para producción. Antes de 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, existe una vulnerabilidad de salto de ruta en la funcionalidad de descompresión de instantáneas de etcd de K3s. Los archivos Zip que contienen miembros de archivo con nombres creados maliciosamente pueden escribirse en ubicaciones arbitrarias del sistema de archivos cuando un administrador restaura el archivo como una instantánea de etcd comprimida. Esta vulnerabilidad está corregida en 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "k3s-io",
          "product": "k3s",
          "versions": [
            {
              "version": ">= 1.35.0-rc1+k3s1, < 1.35.3+k3s1",
              "status": "affected"
            },
            {
              "version": ">= 1.34.0-rc1+k3s1, < 1.34.6+k3s1",
              "status": "affected"
            },
            {
              "version": "< 1.33.10+k3s1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.6,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T17:50:42.464225Z",
          "id": "CVE-2026-54250",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98",
      "source": "[email protected]"
    }
  ]
}