CVE-2026-54250: Path Traversal Vulnerability in K3s etcd Snapshot Decompression

The affected component is the etcd snapshot decompression subsystem within the K3s lightweight Kubernetes distribution. K3s simplifies cluster operations by providing built-in utilities for backing up and restoring cluster state. The vulnerability manifests when an administrator restores an etcd snapshot packaged inside a compressed ZIP archive.

This flaw is classified under CWE-22, representing improper limitation of a pathname to a restricted directory, also known as a Zip Slip vulnerability. The attack surface is exposed directly through the command-line interface when executing snapshot restoration commands. An attacker who successfully exploits this flaw can bypass directory boundaries to write arbitrary files onto the host filesystem.

Because the core K3s process runs with elevated administrative privileges, typically as root, any files written via this mechanism inherit these root privileges. This permits unauthorized modification of critical system directories outside the designated snapshot storage area. The impact is restricted to the host where the recovery command is executed, representing a host-level integrity threat.

The root cause of this vulnerability lies in the naive extraction logic employed by K3s when processing compressed snapshot archives. When a ZIP file is supplied for restoration, the decompression routine iterates over the individual files declared within the archive. For each file, the application constructs the output target path by concatenating the destination directory with the filename header provided by the archive.

In Go, this concatenation is commonly performed using filepath.Join, which automatically runs filepath.Clean on the resulting path string. However, if the filename header contains directory traversal sequences such as ../, filepath.Clean resolves these sequences relative to the destination directory. Consequently, if the archive header specifies ../../../../etc/shadow, the resolved path points outside the designated restoration directory.

To prevent directory traversal, an application must perform explicit validation to ensure that the resolved target path remains a child of the destination directory. Prior to the fix, K3s did not perform any prefix-check or boundary validation on the generated target paths. The decompression process blindly trusted the archive headers, writing the decompressed payloads to arbitrary filesystem locations.

To understand the vulnerable pattern, consider the typical implementation of ZIP file extraction in Go without path verification. The application reads each header, constructs the destination path, and opens the file for writing.

// Vulnerable Implementation Pattern
for _, file := range zipReader.File {
    // Naive concatenation allows path traversal
    targetPath := filepath.Join(destinationDir, file.Name)
    
    // The application creates the directory structure and writes the file
    if err := os.MkdirAll(filepath.Dir(targetPath), 0755); err != nil {
        return err
    }
    
    outFile, err := os.OpenFile(targetPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, file.Mode())
    if err != nil {
        return err
    }
    defer outFile.Close()
    // ... copy contents ...
}

The remediated implementation prevents this directory traversal by verifying the relative relationship between the destination directory and the targeted write path. It ensures that the absolute target path contains the absolute destination directory path as a prefix.

// Remediated Implementation Pattern
cleanDest := filepath.Clean(destinationDir)
for _, file := range zipReader.File {
    targetPath := filepath.Join(cleanDest, file.Name)
    
    // Verify that the target path does not escape the destination directory
    rel, err := filepath.Rel(cleanDest, targetPath)
    if err != nil || strings.HasPrefix(rel, "..") || strings.HasPrefix(rel, string(filepath.Separator)) {
        return fmt.Errorf("illegal file path: %s", file.Name)
    }
    
    // Proceed safely with extraction
    if err := os.MkdirAll(filepath.Dir(targetPath), 0755); err != nil {
        return err
    }
    // ... write contents ...
}

Exploitation of CVE-2026-54250 requires local administrative privileges or a social-engineering vector to coerce an administrator into restoring a corrupted snapshot. The attacker must construct a malicious ZIP archive that includes an etcd snapshot database alongside targeted traversal paths. These paths point to critical system files or executable directories, such as /etc/cron.d or /etc/systemd/system.

Once the ZIP file is staged on the host, the attacker triggers the decompression by executing the K3s server reset command with the target restoration path argument. The command format is k3s server --cluster-reset --cluster-reset-restore-path=/path/to/archive.zip. Upon execution, the K3s server process, running as root, unpacks the snapshot.

The extraction process writes the malicious files to the absolute paths specified in the traversal sequence. For instance, writing a payload into /etc/cron.d/malicious_job forces the host operating system's cron daemon to execute arbitrary commands. This achieves local privilege escalation and full host compromise, bypassing containerization boundaries completely.

The severity of CVE-2026-54250 is evaluated as Medium with a CVSS v3.1 base score of 5.8. The attack complexity is low, but the vulnerability requires high privileges (PR:H) and user interaction (UI:R) to execute. The scope is unchanged (S:U), and the direct impact is limited to integrity (I:H) and availability (A:H) of the host operating system.

While classified as Medium, the real-world impact of successful exploitation is severe. An attacker can overwrite critical system files, including the /etc/shadow file, shell profiles, or systemd services. This capability guarantees immediate execution of arbitrary code with root privileges on the next service initialization or cron schedule execution.

Additionally, an attacker can overwrite internal K3s binaries, local certificate authority files, or database configurations. This can cause persistent denial of service conditions or compromise the identity and security of the entire Kubernetes cluster managed by the affected node.

The recommended remediation is updating the K3s installation to a patched release. For the 1.35 branch, upgrade to version 1.35.3+k3s1 or later. For the 1.34 branch, upgrade to version 1.34.6+k3s1 or later. For legacy installations, migrate to version v1.33.10+k3s1 or later.

In environments where immediate upgrading is not possible, administrators can mitigate the risk by setting the GODEBUG environment variable. By running GODEBUG=zipinsecurepath=0 prior to executing the K3s restore command, the Go runtime actively blocks files containing insecure traversal paths from being decompressed.

Alternatively, administrators can bypass the K3s ZIP extraction logic entirely by manually decompressing the ZIP snapshot using a secure utility like unzip. After ensuring no unexpected files exist in the manual destination folder, the restore operation can be pointed directly to the uncompressed etcd database file, which prevents K3s from executing its internal ZIP parser.