What is the CVSS score of CVE-2026-54250?

CVE-2026-54250 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-54250?

Yes, a public proof-of-concept exploit is available for CVE-2026-54250. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-54250?

Yes, a patch is available for CVE-2026-54250. Update the affected software to the latest version immediately.

K3s CVE-2026-54250

EUVD-2026-39512 MEDIUM

Path Traversal (CWE-22)

2026-06-25 GitHub_M

GHSA-jxr7-mqhw-9p98

Path Traversal Kubernetes Suse K3S

5.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.8 MEDIUM

AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

vuln.today AI

5.8 MEDIUM

Administrator must locally restore the archive (AV:L, PR:H, UI:R); arbitrary write causes integrity and availability harm but no direct data disclosure (C:N).

3.1 AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 25, 2026 - 20:03 EUVD

Analysis Generated

Jun 25, 2026 - 18:59 vuln.today

DescriptionCVE.org

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1.

AnalysisAI

Arbitrary filesystem write via zip-slip in K3s etcd snapshot restoration affects all K3s versions prior to 1.35.3+k3s1, 1.34.6+k3s1, and v1.33.10+k3s1. A maliciously crafted zip archive with path-traversal entries in member filenames (e.g., '../../etc/cron.d/evil') can overwrite arbitrary files on the host filesystem when an administrator performs a compressed etcd snapshot restore. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Technical ContextAI

K3s (cpe:2.3:a:k3s-io:k3s:*:*:*:*:*:*:*:*) is a CNCF-certified, production-ready lightweight Kubernetes distribution designed for edge, IoT, and resource-constrained environments. The vulnerability resides in its etcd snapshot decompression routine, which processes zip archives during cluster state restoration. CWE-22 (Path Traversal) - the root cause class - arises when an application extracts zip archive members without sanitizing or canonicalizing their embedded filenames. This class of flaw is commonly called 'Zip Slip': a zip entry named '../../../../etc/passwd' can resolve outside the intended extraction directory when joined with the destination path using naive string concatenation. K3s failed to strip or reject such directory-traversal sequences prior to writing extracted content, allowing attacker-controlled paths to resolve to arbitrary absolute filesystem locations under the privileges of the restoring process (typically root or a high-privilege service account).

RemediationAI

Upgrade K3s to one of the vendor-released patched versions: 1.35.3+k3s1 (v1.35 branch), 1.34.6+k3s1 (v1.34 branch), or v1.33.10+k3s1 (v1.33 branch), as documented in the GitHub Security Advisory at https://github.com/k3s-io/k3s/security/advisories/GHSA-jxr7-mqhw-9p98. As a compensating control prior to patching, administrators should strictly verify the provenance and integrity (e.g., cryptographic checksum or signature) of any etcd snapshot archive before restoring it, and should only restore snapshots originating from trusted, internally managed sources. Inspecting zip archive member names for directory traversal sequences (entries containing '../') before restoration is an additional manual safeguard. Restricting who can supply snapshot files for restoration and auditing all etcd restore operations reduces the social-engineering attack surface. These compensating controls introduce operational overhead but do not carry significant functional side effects.