Every CVE Search/ Get API key

CVE-2021-20218

Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client

7.4 HighFix available

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

1.31%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.4

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Record
CVE-2021-20218
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Record
CVE-2021-20218
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2022-4447 No score

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Record
EUVD-2022-4447
Updated
2026-11-03
GitHub AdvisoriesGHSA-jwh2-ffg4-48xc 7.4

Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Record
GHSA-jwh2-ffg4-48xc
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSV 7.4

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Record
CVE-2021-20218
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVGHSA-jwh2-ffg4-48xc 7.4

Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Record
GHSA-jwh2-ffg4-48xc
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSVRHSA-2021:1006 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.7.5 security and bug fix update

Record
RHSA-2021:1006
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
io.fabric8:kubernetes-client
Maven
 4.2.0 to 4.7.1
4.7.2
io.fabric8:kubernetes-client
Maven
 4.8.0 to 4.11.1
4.11.2
io.fabric8:kubernetes-client
Maven
 4.12.0 to 4.13.1
4.13.2
io.fabric8:kubernetes-client
Maven
 5.0.0 to 5.0.1
5.0.2
io.fabric8:kubernetes-client
Maven
 4.2.0 up to 4.7.2, plus listed versions
4.2.14.2.24.3.04.3.14.4.0
Show 12 moreShow less
4.4.14.4.24.5.04.5.14.5.24.6.04.6.14.6.24.6.34.6.44.7.04.7.1
4.7.2
io.fabric8:kubernetes-client
Maven
 4.8.0 up to 4.11.2, plus listed versions
4.10.04.10.14.10.24.10.34.11.0
Show 4 moreShow less
4.11.14.9.04.9.14.9.2
4.11.2
io.fabric8:kubernetes-client
Maven
 4.12.0 up to 4.13.2, plus listed versions
4.13.04.13.1
4.13.2
io.fabric8:kubernetes-client
Maven
 5.0.0 up to 5.0.2, plus listed versions
5.0.1
5.0.2
cri-o
Red Hat:openshift:4.7::el7
 before 0:1.20.2-4.rhaos4.7.gitd5a999a.el7
0:1.20.2-4.rhaos4.7.gitd5a999a.el7
cri-o-debuginfo
Red Hat:openshift:4.7::el7
 before 0:1.20.2-4.rhaos4.7.gitd5a999a.el7
0:1.20.2-4.rhaos4.7.gitd5a999a.el7
Show 8 moreShow less
Affected packages
PackageAffectedFixed
cri-o
Red Hat:openshift:4.7::el8
 before 0:1.20.2-4.rhaos4.7.gitd5a999a.el8
0:1.20.2-4.rhaos4.7.gitd5a999a.el8
cri-o-debuginfo
Red Hat:openshift:4.7::el8
 before 0:1.20.2-4.rhaos4.7.gitd5a999a.el8
0:1.20.2-4.rhaos4.7.gitd5a999a.el8
cri-o-debugsource
Red Hat:openshift:4.7::el8
 before 0:1.20.2-4.rhaos4.7.gitd5a999a.el8
0:1.20.2-4.rhaos4.7.gitd5a999a.el8
openshift-clients
Red Hat:openshift:4.7::el7
 before 0:4.7.0-202103251046.p0.git.3957.c4da68b.el7
0:4.7.0-202103251046.p0.git.3957.c4da68b.el7
openshift-clients-redistributable
Red Hat:openshift:4.7::el7
 before 0:4.7.0-202103251046.p0.git.3957.c4da68b.el7
0:4.7.0-202103251046.p0.git.3957.c4da68b.el7
openshift-clients
Red Hat:openshift:4.7::el8
 before 0:4.7.0-202103251046.p0.git.3957.c4da68b.el8
0:4.7.0-202103251046.p0.git.3957.c4da68b.el8
openshift-clients-redistributable
Red Hat:openshift:4.7::el8
 before 0:4.7.0-202103251046.p0.git.3957.c4da68b.el8
0:4.7.0-202103251046.p0.git.3957.c4da68b.el8
jenkins-2-plugins
Red Hat:openshift:4.7::el8
 before 0:4.7.1616671397-1.el8
0:4.7.1616671397-1.el8

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-20218 is a high vulnerability (CVSS 7.4) in Redhat Kubernetes-client, published March 16, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in io.fabric8:kubernetes-client 4.7.2.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open