Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-21T18:17:09.580Z",
  "pubdate": "2026-09-21T18:17:09.580Z",
  "executiveSummary": "KubeEdge versions 1.16.0 through 1.21.1, 1.22.0-1.22.1, and 1.23.0 are vulnerable to a path traversal vulnerability during the extraction of tar.gz archives. The vulnerability exists within the DecompressTarGz function located in keadm/cmd/keadm/app/cmd/util/common.go.\nThe flaw allows an attacker to manipulate archive entry names, enabling the writing or overwriting of arbitrary files on the host filesystem during the 'keadm join' or installation process on Windows edge nodes.\nThis occurs because the application fails to adequately validate archive entry paths, permitting the use of parent-directory sequences (../), Windows-style backslashes, absolute paths, or drive-prefixed paths.\nAn attacker who can provide a malicious or untrusted download source can achieve code execution or system persistence by overwriting critical configuration, executable, or system service files. The exploit operates with the privileges of the keadm process, potentially leading to full system compromise depending on the execution context. Users are advised to upgrade to the patched versions immediately.",
  "technicalDetails": "The root cause of this vulnerability is improper validation of archive entry filenames within the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go. When processing compressed tar.gz files, the function joins the archive entry names directly to the target extraction directory without checking for malicious path components.\nIn the context of Windows edge nodes, the underlying operating system's filesystem APIs interpret various path patterns that can bypass intended directory restrictions. Specifically, the function fails to sanitize or neutralize path traversal sequences (../), absolute Windows paths (e.g., C:\\Windows\\System32\\...), or drive-prefixed paths. By crafting a tar.gz archive with entries containing these sequences, an attacker can escape the designated installation destination.\nThe attack flow proceeds as follows: First, an attacker positions a malicious tar.gz archive to be downloaded by the keadm utility, typically by compromising a download source or performing a man-in-the-middle attack if TLS is not enforced or verified. Second, the attacker triggers the 'keadm join' or installation process. Third, as keadm executes DecompressTarGz, it iterates through the archive entries. Upon encountering an entry with a malicious path prefix (e.g., '..\\..\\..\\Windows\\System32\\evil.exe'), the join operation resolves the path to an arbitrary location outside the target directory.\nThe extraction process then writes the content of the archive entry into this resolved location. If the keadm process runs with elevated privileges, the attacker can overwrite sensitive files such as executable binaries, configuration files, or system services. This leads to arbitrary code execution upon the next trigger of the overwritten component or system reboot.\nThe vulnerability is present in versions 1.16.0 through 1.21.1, 1.22.0-1.22.1, and 1.23.0. Exploitation requires the victim to execute the keadm command while pointed to a malicious or compromised source. No specialized authentication is required beyond the attacker's ability to influence the archive content or the source URI provided to the keadm tool. The impact is significant, as it grants the attacker the ability to inject files onto the host system, effectively bypassing the intended installation boundary and facilitating persistent modification or full system compromise."
}