---
id: CVE-2026-54250
aliases:
  - GHSA-jxr7-mqhw-9p98
title: 'K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression'
summary: 'K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression'
severity: medium
cvss: 5.8
cwe:
  - CWE-22
vendor: k3s-io
product: github.com/k3s-io/k3s
ecosystem: go
affected:
  - 'github.com/k3s-io/k3s >= 1.35.0-rc1, < 1.35.3'
  - 'github.com/k3s-io/k3s >= 1.34.0-rc1, < 1.34.6'
  - github.com/k3s-io/k3s < 1.33.10
patched:
  - github.com/k3s-io/k3s 1.35.3
  - github.com/k3s-io/k3s 1.34.6
  - github.com/k3s-io/k3s 1.33.10
published: '2026-07-14'
updated: '2026-07-14'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-jxr7-mqhw-9p98'
references:
  - url: 'https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54250'
  - url: 'https://github.com/advisories/GHSA-jxr7-mqhw-9p98'
tags:
  - ghsa
  - go
epss: 0.00167
epssPercentile: 0.05319
ingestedAt: '2026-07-14T18:38:32.971Z'
---

## Overview

#### Summary

A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names (e.g., `../../../../etc/password`) can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot.

#### Mitigations

* Enable golang's built-in [insecure path protections](https://pkg.go.dev/archive/zip#NewReader) when restoring snapshots by setting the`GODEBUG` environment variable:
    ```bash
    GODEBUG=zipinsecurepath=0 k3s server --cluster-reset --cluster-reset-restore-path=/path/to/snapshot.zip
    ```
* Manually extract the snapshot from the zip archive before restoring it. If the snapshot to be restored does not end with `.zip`, the vulnerable extraction code will not be executed.

#### Additional Notes

Administrators should be aware of the cautions noted in the "Security" section of the documentation on [Restoring Snapshots](https://docs.k3s.io/cli/etcd-snapshot#security).

## Affected packages

- `github.com/k3s-io/k3s >= 1.35.0-rc1, < 1.35.3`
- `github.com/k3s-io/k3s >= 1.34.0-rc1, < 1.34.6`
- `github.com/k3s-io/k3s < 1.33.10`

## Remediation

Upgrade to a patched release:

- `github.com/k3s-io/k3s 1.35.3`
- `github.com/k3s-io/k3s 1.34.6`
- `github.com/k3s-io/k3s 1.33.10`