{"id":"CVE-2026-54250","aliases":["GHSA-jxr7-mqhw-9p98"],"title":"K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression","summary":"K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression","severity":"medium","cvss":5.8,"cwe":["CWE-22"],"vendor":"k3s-io","product":"github.com/k3s-io/k3s","ecosystem":"go","affected":["github.com/k3s-io/k3s >= 1.35.0-rc1, < 1.35.3","github.com/k3s-io/k3s >= 1.34.0-rc1, < 1.34.6","github.com/k3s-io/k3s < 1.33.10"],"patched":["github.com/k3s-io/k3s 1.35.3","github.com/k3s-io/k3s 1.34.6","github.com/k3s-io/k3s 1.33.10"],"published":"2026-07-14","updated":"2026-07-14","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-jxr7-mqhw-9p98","references":[{"url":"https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54250"},{"url":"https://github.com/advisories/GHSA-jxr7-mqhw-9p98"}],"tags":["ghsa","go"],"epss":0.00167,"epssPercentile":0.06393,"ingestedAt":"2026-07-14T18:38:32.971Z","slug":"CVE-2026-54250","body":"## Overview\n\n#### Summary\n\nA path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names (e.g., `../../../../etc/password`) can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot.\n\n#### Mitigations\n\n* Enable golang's built-in [insecure path protections](https://pkg.go.dev/archive/zip#NewReader) when restoring snapshots by setting the`GODEBUG` environment variable:\n    ```bash\n    GODEBUG=zipinsecurepath=0 k3s server --cluster-reset --cluster-reset-restore-path=/path/to/snapshot.zip\n    ```\n* Manually extract the snapshot from the zip archive before restoring it. If the snapshot to be restored does not end with `.zip`, the vulnerable extraction code will not be executed.\n\n#### Additional Notes\n\nAdministrators should be aware of the cautions noted in the \"Security\" section of the documentation on [Restoring Snapshots](https://docs.k3s.io/cli/etcd-snapshot#security).\n\n## Affected packages\n\n- `github.com/k3s-io/k3s >= 1.35.0-rc1, < 1.35.3`\n- `github.com/k3s-io/k3s >= 1.34.0-rc1, < 1.34.6`\n- `github.com/k3s-io/k3s < 1.33.10`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/k3s-io/k3s 1.35.3`\n- `github.com/k3s-io/k3s 1.34.6`\n- `github.com/k3s-io/k3s 1.33.10`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}