CVE-2026-62369: KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function.
Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory.
The issue is particularly relevant to Windows edge nodes during the keadm join or installation process when keadm extracts downloaded component archives.
References
- github.com/advisories/GHSA-9vm9-pqxx-x83v
- github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md
- github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md
- github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md
- github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d
- github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047
- github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40
- github.com/kubeedge/kubeedge/pull/7028
- github.com/kubeedge/kubeedge/pull/7029
- github.com/kubeedge/kubeedge/pull/7030
- github.com/kubeedge/kubeedge/releases/tag/v1.21.2
- github.com/kubeedge/kubeedge/releases/tag/v1.22.2
- github.com/kubeedge/kubeedge/releases/tag/v1.23.1
- github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v
- nvd.nist.gov/vuln/detail/CVE-2026-62369
Code Behaviors & Features
Detect and mitigate CVE-2026-62369 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →