Every CVE Search/ Get API key

CVE-2019-11251

kubectl cp allows symlink directory traversal

4.8 MediumFix available

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

2.62%Up 2.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 4.8

kubectl cp allows symlink directory traversal

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Record
CVE-2019-11251
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-61
Updated
2026-11-02
EUVDEUVD-2021-0974 4.8

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Record
EUVD-2021-0974
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-6qfg-8799-r575 5.7

Kubernetes kubectl cp Vulnerable to Symlink Attack

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Record
GHSA-6qfg-8799-r575
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-59, CWE-61
Updated
2026-11-02
NVD 4.8

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Record
CVE-2019-11251
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-61, CWE-59
Updated
2026-11-02
OSV 5.7

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Record
CVE-2019-11251
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-6qfg-8799-r575 5.7

Kubernetes kubectl cp Vulnerable to Symlink Attack

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Record
GHSA-6qfg-8799-r575
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-59, CWE-61
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2019:3266 5.3

Red Hat Security Advisory: OpenShift Container Platform 4.1 openshift security update

Record
RHSA-2019:3266
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2019:3811 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift security update

Record
RHSA-2019:3811
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:3905 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update

Record
RHSA-2019:3905
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11251 4.8

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Record
UBUNTU-CVE-2019-11251
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGO-2022-0802 No score

Kubernetes kubectl cp Vulnerable to Symlink Attack in k8s.io/kubernetes

Kubernetes kubectl cp Vulnerable to Symlink Attack in k8s.io/kubernetes

Record
GO-2022-0802
Updated
2026-11-02
OSVopenSUSE-SU-2025:15424-1 No score

govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15424-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
k8s.io/kubernetes
Go
 1.13.10 up to 1.13.11
1.13.11
k8s.io/kubernetes
Go
 1.14.6 up to 1.14.7
1.14.7
k8s.io/kubernetes
Go
 1.15.3 up to 1.16.0
1.16.0
k8s.io/kubernetes
Go
 1.13.10 up to 1.13.11, 1.14.6 up to 1.14.7, 1.15.3 up to 1.16.0
1.13.111.14.71.16.0
openshift
Red Hat:openshift:4.1::el7
 before 0:4.1.21-201910220952.git.0.493dbf6.el7
0:4.1.21-201910220952.git.0.493dbf6.el7
openshift-clients
Red Hat:openshift:4.1::el7
 before 0:4.1.21-201910220952.git.0.493dbf6.el7
0:4.1.21-201910220952.git.0.493dbf6.el7
openshift-clients-redistributable
Red Hat:openshift:4.1::el7
 before 0:4.1.21-201910220952.git.0.493dbf6.el7
0:4.1.21-201910220952.git.0.493dbf6.el7
openshift-hyperkube
Red Hat:openshift:4.1::el7
 before 0:4.1.21-201910220952.git.0.493dbf6.el7
0:4.1.21-201910220952.git.0.493dbf6.el7
openshift
Red Hat:openshift:4.1::el8
 before 0:4.1.21-201910220952.git.0.493dbf6.el8
0:4.1.21-201910220952.git.0.493dbf6.el8
openshift-clients
Red Hat:openshift:4.1::el8
 before 0:4.1.21-201910220952.git.0.493dbf6.el8
0:4.1.21-201910220952.git.0.493dbf6.el8
Show 30 moreShow less
Affected packages
PackageAffectedFixed
openshift-clients-redistributable
Red Hat:openshift:4.1::el8
 before 0:4.1.21-201910220952.git.0.493dbf6.el8
0:4.1.21-201910220952.git.0.493dbf6.el8
openshift-hyperkube
Red Hat:openshift:4.1::el8
 before 0:4.1.21-201910220952.git.0.493dbf6.el8
0:4.1.21-201910220952.git.0.493dbf6.el8
atomic-openshift
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-clients
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-clients-redistributable
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-cluster-capacity
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-docker-excluder
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-excluder
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-federation-services
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-master
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-node
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-pod
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-service-catalog
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-template-service-broker
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift-tests
Red Hat:openshift:3.9::el7
 before 0:3.9.102-1.git.0.6411f52.el7
0:3.9.102-1.git.0.6411f52.el7
atomic-openshift
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-clients
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-clients-redistributable
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-docker-excluder
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-excluder
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-hyperkube
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-hypershift
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-master
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-node
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-pod
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-template-service-broker
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
atomic-openshift-tests
Red Hat:openshift:3.11::el7
 before 0:3.11.154-1.git.0.7a097ad.el7
0:3.11.154-1.git.0.7a097ad.el7
govulncheck-vulndb
openSUSE:Tumbleweed
 before 0.0.20250807T150727-1.1
0.0.20250807T150727-1.1

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11251 is a medium vulnerability (CVSS 4.8) in Kubernetes, published February 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.62%, the 85th percentile. Fixed in k8s.io/kubernetes 1.13.11.

References

Show 69 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open