Maciej Szulik

**Name of the Vulnerable Software and Affected Versions** kubectl (affected versions not specified) **Description** A path traversal issue exists in the `kubectl cp` command for clients running on Windows. When copying files from a container, the client executes the `tar` binary within the container to create an archive, which is then transferred and unpacked on the local machine. If the `tar` binary inside the container is malicious, it can generate unexpected output that allows an attacker controlling the container contents to write files to arbitrary paths on the local user's machine, subject to the local user's system permissions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.