Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN759
_____________________________________________________________________


DATE                : 16/07/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running k3s (Go) versions prior to
                       1.35.3+k3s1, 1.34.6+k3s1, 1.33.10+k3s1.
 
=====================================================================

https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98
_____________________________________________________________________



ZIP Archive Path Traversal Vulnerability in etcd Snapshot
Decompression

Moderate
cwayne18 published GHSA-jxr7-mqhw-9p98

Package
github.com/k3s-io/k3s (Go)

Affected versions
<=v1.35.2+k3s1
<=v1.34.5+k3s1
<=v1.33.9+k3s

Patched versions
v1.35.3+k3s1
v1.34.6+k3s1
v1.33.10+k3s1


Description

Summary

A path traversal vulnerability exists in K3s's etcd snapshot
decompression functionality. Zip files containing archive members
with maliciously crafted names (e.g., ../../../../etc/password)
can be written to arbitrary locations on the filesystem when an
administrator restores the archive as a compressed etcd snapshot.


Mitigations

    Enable golang's built-in insecure path protections when
restoring snapshots by setting theGODEBUG environment variable:

    GODEBUG=zipinsecurepath=0 k3s server --cluster-reset --cluster-reset-restore-path=/path/to/snapshot.zip

    Manually extract the snapshot from the zip archive before
restoring it. If the snapshot to be restored does not end with
.zip, the vulnerable extraction code will not be executed.

Additional Notes

Administrators should be aware of the cautions noted in the
"Security" section of the documentation on Restoring
Snapshots.


Severity
Moderate
5.8/ 10

CVSS v3 base metrics
Attack vector
Local
Attack complexity
Low
Privileges required
High
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

CVE ID
CVE-2026-54250

Weaknesses
Weakness CWE-22

Credits

    @f1veT f1veT Reporter




=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================