CVE-2026-54250

Name of the Vulnerable Software and Affected Versions K3s versions prior to 1.35.3+k3s1 K3s versions prior to 1.34.6+k3s1 K3s versions prior to 1.33.10+k3s1

Description A path traversal issue exists in the etcd snapshot decompression functionality. This occurs when an administrator restores a compressed etcd snapshot containing a zip file with maliciously crafted archive member names, allowing files to be written to arbitrary locations on the filesystem.

Recommendations Update to version 1.35.3+k3s1. Update to version 1.34.6+k3s1. Update to version 1.33.10+k3s1.