{"id":"CVE-2026-91200","title":"DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream","summary":"DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the d…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"vendor":"devspace","product":"devspace","affected":["devspace <= 6.3.21"],"published":"2026-09-14","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:47.790","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91200","references":[{"url":"https://github.com/devspace-sh/devspace","label":"disclosure@vulncheck.com"},{"url":"https://github.com/devspace-sh/devspace/blob/7f272dcf90653fa9b42bc4347f7f3f9a52b0e8b5/pkg/devspace/sync/tar.go#L68-L82","label":"disclosure@vulncheck.com"},{"url":"https://github.com/devspace-sh/devspace/blob/7f272dcf90653fa9b42bc4347f7f3f9a52b0e8b5/pkg/devspace/sync/util.go#L9-L11","label":"disclosure@vulncheck.com"},{"url":"https://github.com/devspace-sh/devspace/issues/3290","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/devspace-through-6.3.21-path-traversal-via-tar-extraction","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.0042,"epssPercentile":0.35956,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-15T13:47:03.145976Z"},"ingestedAt":"2026-09-14T23:17:06.517Z","slug":"CVE-2026-91200","body":"## Overview\n\nDevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}