{"id":"CVE-2026-62369","aliases":["GHSA-9vm9-pqxx-x83v","GO-2026-6563"],"url":"https://o3.security/vulnerability/CVE-2026-62369","summary":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join","details":"## Description\n\nKubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction function.\n\nArchive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory.\n\nThe issue is particularly relevant to Windows edge nodes during the `keadm join` or installation process when `keadm` extracts downloaded component archives.\n\n## Impact\n\nAn attacker who can cause an affected `keadm` process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running `keadm`.\n\nOn Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the `keadm` process, successful exploitation could lead to persistent system modification or code execution.\n\nExploitation requires the attacker to influence the contents of an archive processed by `keadm`, such as through a compromised, replaced, or otherwise untrusted download source.\n\n## Patches\n\nThe extraction logic now:\n\n* resolves the destination directory to an absolute path;\n* rejects empty archive entry names;\n* normalizes Windows-style path separators before validation;\n* rejects parent-directory traversal paths;\n* rejects absolute and Windows drive-prefixed paths;\n* uses `filepath-securejoin` to ensure extracted files remain within the destination directory.\n\nFixes are planned for the following maintained releases:\n\n* v1.23.1\n* v1.22.2\n* v1.21.2\n\n## Workarounds\n\nUntil a patched release is available:\n\n* only install or join edge nodes using trusted KubeEdge package sources;\n* verify the integrity and origin of downloaded archives before extraction;\n* do not use custom or untrusted component archives with `keadm`;\n* restrict write permissions and administrative privileges for the account running `keadm`;\n* avoid performing Windows edge-node installation or join operations when the package source cannot be trusted.\n\n## Credits\n\nKubeEdge thanks Sang-Hoon Choi ([KoreaSecurity](https://github.com/KoreaSecurity), Sejong University)\nfor responsibly reporting this issue and for coordinating with the KubeEdge\nmaintainers through the security disclosure process.","published":"2026-09-21T17:10:57.979Z","modified":"2026-10-21T02:58:54.374565475Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/kubeedge/kubeedge","fixedVersion":"1.21.2"},{"ecosystem":"Go","name":"github.com/kubeedge/kubeedge","fixedVersion":"1.22.2"},{"ecosystem":"Go","name":"github.com/kubeedge/kubeedge","fixedVersion":"1.23.1"}],"fix":{"url":"https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d","label":"kubeedge/kubeedge@47767b7"},"references":[{"type":"WEB","url":"https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md"},{"type":"WEB","url":"https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md"},{"type":"WEB","url":"https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md"},{"type":"WEB","url":"https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2"},{"type":"WEB","url":"https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2"},{"type":"WEB","url":"https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62369.json"},{"type":"ADVISORY","url":"https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62369"},{"type":"FIX","url":"https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d"},{"type":"FIX","url":"https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047"},{"type":"FIX","url":"https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40"},{"type":"FIX","url":"https://github.com/kubeedge/kubeedge/pull/7028"},{"type":"FIX","url":"https://github.com/kubeedge/kubeedge/pull/7029"},{"type":"FIX","url":"https://github.com/kubeedge/kubeedge/pull/7030"},{"type":"PACKAGE","url":"https://github.com/kubeedge/kubeedge"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:54.374565475Z"}}