CVE-2026-62369

Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.16.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0

Description The DecompressTarGz() function in keadm/cmd/keadm/app/cmd/util/common.go fails to sufficiently validate archive entry names when joining them to the extraction destination. During installation or the join process on Windows edge nodes, a malicious archive from an untrusted source can use parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths to escape the intended directory. This allows the keadm process to write or overwrite files using its own privileges, which could lead to the modification of configuration, executable, or service files, resulting in persistent system modification or code execution.

Recommendations Update to version 1.21.2. Update to version 1.22.2. Update to version 1.23.1.