CVE-2026-62369

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Description

KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function.

Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory.

The issue is particularly relevant to Windows edge nodes during the keadm join or installation process when keadm extracts downloaded component archives.

Impact

An attacker who can cause an affected keadm process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running keadm.

On Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the keadm process, successful exploitation could lead to persistent system modification or code execution.

Exploitation requires the attacker to influence the contents of an archive processed by keadm, such as through a compromised, replaced, or otherwise untrusted download source.

Patches

The extraction logic now:

• resolves the destination directory to an absolute path;
• rejects empty archive entry names;
• normalizes Windows-style path separators before validation;
• rejects parent-directory traversal paths;
• rejects absolute and Windows drive-prefixed paths;
• uses filepath-securejoin to ensure extracted files remain within the destination directory.

Fixes are planned for the following maintained releases:

• v1.23.1
• v1.22.2
• v1.21.2

Workarounds

Until a patched release is available:

• only install or join edge nodes using trusted KubeEdge package sources;
• verify the integrity and origin of downloaded archives before extraction;
• do not use custom or untrusted component archives with keadm;
• restrict write permissions and administrative privileges for the account running keadm;
• avoid performing Windows edge-node installation or join operations when the package source cannot be trusted.

Credits

KubeEdge thanks Sang-Hoon Choi (KoreaSecurity, Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Description

KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function.

Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory.

The issue is particularly relevant to Windows edge nodes during the keadm join or installation process when keadm extracts downloaded component archives.

Impact

An attacker who can cause an affected keadm process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running keadm.

On Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the keadm process, successful exploitation could lead to persistent system modification or code execution.

Exploitation requires the attacker to influence the contents of an archive processed by keadm, such as through a compromised, replaced, or otherwise untrusted download source.

Patches

The extraction logic now:

• resolves the destination directory to an absolute path;
• rejects empty archive entry names;
• normalizes Windows-style path separators before validation;
• rejects parent-directory traversal paths;
• rejects absolute and Windows drive-prefixed paths;
• uses filepath-securejoin to ensure extracted files remain within the destination directory.

Fixes are planned for the following maintained releases:

• v1.23.1
• v1.22.2
• v1.21.2

Workarounds

Until a patched release is available:

• only install or join edge nodes using trusted KubeEdge package sources;
• verify the integrity and origin of downloaded archives before extraction;
• do not use custom or untrusted component archives with keadm;
• restrict write permissions and administrative privileges for the account running keadm;
• avoid performing Windows edge-node installation or join operations when the package source cannot be trusted.

Credits

KubeEdge thanks Sang-Hoon Choi (KoreaSecurity, Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge