Kubernetes kubectl cp path traversal enables arbitrary local file writes on Windows

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary in the container is malicious, it can execute arbitrary code and emit unexpected output, allowing an attacker who controls container contents to write files to arbitrary paths on the user's local machine when kubectl cp is invoked, limited only by the system permissions of the local user. This issue only affects kubectl clients running on Windows.

The vulnerability is confirmed for Kubernetes kubectl clients running on Windows and using kubectl cp to copy files from containers.

• kubectl v1.34.0 through v1.34.11: affected; the identified fixed release is v1.34.12.
• kubectl v1.35.0 through v1.35.8: affected; the identified fixed release is v1.35.9.
• kubectl v1.36.0 through v1.36.4: affected; the identified fixed release is v1.36.5.

The normalized record carries default_status as unaffected, but the advisory explicitly enumerates only the affected branches above. The status of branches not listed should not be inferred without separate confirmation.

The kubectl cp command runs tar inside the container to create an archive, transfers that archive over the network, and unpacks it on the local machine. If an attacker controls the tar binary or container contents, unexpected archive output can cause the Windows-side extraction process to write outside the intended path. This is a CWE-22 path traversal issue, with the resulting writes limited by the permissions of the local user account. Preconditions are a Windows kubectl client, a user-initiated copy from a container, and attacker control of the container contents or the tar binary used there. The available evidence does not identify the exact extraction function, path-normalization logic, or missing validation that enables the traversal.

The issue is reached through a kubectl cp operation that copies files from a container to the user's machine. The supplied assessment describes the attack vector as adjacent, attack complexity as low, privileges required as high, and user interaction as required. The user must run kubectl on Windows and copy from a container whose contents are not fully trusted, while the attacker must control the container contents or its tar binary. The normalized record does not record a public exploit and does not establish known exploitation. That does not prove exploitation is impossible.

• The primary technical outcome is path traversal leading to arbitrary file writes on the local machine, limited by the permissions of the Windows user running kubectl.
• The supplied assessment records low confidentiality impact, high integrity impact, and no availability impact.
• The flaw crosses from container interaction to the user's machine because the archive supplied by the container is processed and unpacked locally.
• Organisational consequences may include modification of operational data or workstation files, but the actual severity depends on the account's permissions and the paths it can write.
• The available evidence does not establish unrestricted file reading, system-level privilege escalation, or service disruption.

• Files on a Windows user's machine may be created or overwritten at locations where that account has write access.
• Local file modification could affect user data, configuration, or operational workflows, depending on the target path and account permissions.
• The primary exposure is for operators who use Windows kubectl cp to retrieve files from containers that are not fully trusted.
• The available record does not identify a specific incident, victim, or breach scenario, so it should not be treated as evidence that a compromise occurred in a particular environment.

1. Upgrade the Windows kubectl client to the fixed release for its branch: v1.34.12 for the v1.34 branch, v1.35.9 for the v1.35 branch, or v1.36.5 for the v1.36 branch.
2. Before upgrading, use kubectl cp only with trusted containers, or avoid copying from untrusted containers on Windows.
3. Inventory clients by release branch; a fix for one branch does not by itself demonstrate that other branches are fixed.
4. If local files appear to have been written unexpectedly after a copy operation, preserve audit telemetry, session information, and relevant files for investigation and report the evidence to Kubernetes.

• Inventory Windows systems that have kubectl installed and check the client version with kubectl version --client.
• Identify workflows and users that run kubectl cp to copy files from containers, especially when the source container is controlled by another party or is not fully trusted.
• Review file-integrity and audit telemetry on Windows for unexpected file creation or modification around suspicious copy operations.
• Correlate changed files with the account that ran kubectl; this is a precautionary review, not a Kubernetes-defined IOC.
• The available sources do not specify a dedicated log event or concrete IOC for this vulnerability.