← CVE Intelligence

CVE-2026-15687

Path traversal via non-tar copyDirectoryFromPod PUBLISHED

Description (CNA)

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.

Affected (CNA)

Vendor / productVersions
Kubernetes / kubernetes-client/javaaffected 10.0.0 before 25.0.1; affected 26.0.0; unaffected 25.0.1; unaffected 26.0.1; unaffected 27.0.0

CWE

CWE-22

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.