Description

A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access. Upgrading to version 4.0.16 is recommended to address this issue. This patch is called d90f77314c7d4f2b53cf2425844bde2315bd26d2. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.8",
  "pubDate": "2026-11-06T15:17:20.670Z",
  "pubdate": "2026-11-06T15:17:20.670Z",
  "executiveSummary": "A security weakness exists in Kubescape versions up to 4.0.15, specifically within the output handling functionality.\nThe vulnerability is characterized as an insecure file handling flaw where manipulation of the outputFile argument can lead to unauthorized permission issues.\nThe vulnerability resides in the GetWriter function located in core/pkg/resultshandling/printer/printresults.go.\nThe impact involves potential unauthorized filesystem access or corruption depending on the context of the execution environment.\nExploitation requires local access to the system where the Kubescape binary is being executed, meaning an attacker must already have a foothold or physical access to the host.\nThis vulnerability poses a risk to system integrity and data confidentiality, as it potentially allows for unintended file modifications.\nSuccessful exploitation depends on the ability of an attacker to influence the input parameters provided to the Output component.",
  "technicalDetails": "The vulnerability is located in the Output component, specifically within the GetWriter function defined in core/pkg/resultshandling/printer/printresults.go. This function is responsible for initializing the writers used to handle the output of scan results. The core issue involves insufficient validation or sanitization of the outputFile argument passed to this function.\nWhen an attacker provides a crafted value for the outputFile argument, they can potentially influence where the application writes data or how it interacts with the underlying filesystem. Because the application logic does not adequately verify the destination of the file pointer, the application may inadvertently open or create files in locations outside of the intended directory.\nThe attack flow begins with the attacker identifying a mechanism to pass arbitrary input to the Kubescape CLI or associated component that triggers the GetWriter logic. By manipulating the path provided to the outputFile argument, the attacker can leverage the application's process permissions to perform file operations. If the application is executed with elevated privileges, this may allow the overwriting or creation of sensitive system files, leading to privilege escalation or system instability.\nThe requirement for local access suggests that the attacker must have a shell or local execution environment on the target host to manipulate the command-line arguments or environment variables influencing the outputFile parameter. Once the malicious path is supplied, the GetWriter function attempts to instantiate a file writer at the attacker-specified location. This behavior persists until the patched version 4.0.16 is implemented, which presumably includes stricter input validation or path canonicalization checks to ensure that file output is restricted to authorized directories.\nThe lack of robust path validation in versions 4.0.15 and below allows for this path traversal-style manipulation, where the file pointer is directed to a sensitive filesystem path. This is a critical security oversight in components handling external user-supplied paths, as it bypasses intended sandboxing or directory constraints that should be inherent in the output generation process."
}