dbcve.org
Path TraversalWeakness · CWE-22

CVE-2026-54250

MEDIUM · 5.8 CVSS v3.1 Published 2026-06-25
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
58/100
Remediation priority · Elevated
8 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

K3s contains a path traversal vulnerability in its etcd snapshot decompression functionality. When an administrator restores a compressed etcd snapshot archive, maliciously crafted zip file entries with path traversal sequences (e.g., ../../../etc/passwd) can write files to arbitrary locations outside the intended snapshot directory.

MitigationUpgrade K3s to version 1.35.3+k3s1, 1.34.6+k3s1, or v1.33.10+k3s1 or later. Until patched, only restore etcd snapshots from trusted sources.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check the installed K3s version
    Run `k3s --version` or check the systemd service version with `systemctl status k3s`
    Affected if The version is earlier than 1.35.3+k3s1, 1.34.6+k3s1, or 1.33.10+k3s1 (meaning the patch is not applied)
  2. Identify if etcd snapshots have been restored
    Check for snapshot files in the default directory `/var/lib/rancher/k3s/server/db/etcd` or a custom snapshot path configured in the K3s config
    Affected if Compressed (zip) etcd snapshot archives exist and have been restored on this K3s node
  3. Locate any compressed snapshot archives
    Look for .zip files in snapshot directories: `find /var/lib/rancher/k3s -name '*.zip' 2>/dev/null`
    Affected if Zip-formatted snapshot archives are present on the system
  4. Determine if snapshots from untrusted sources were imported
    Review any scripts, automation, or manual commands that performed etcd snapshot restore operations, checking for use of the `--snapshot-name` or `--snapshot-format=zip` flags
    Affected if A snapshot restore was performed using a zip-compressed archive from a source outside your organization

You are affected if your K3s version is earlier than the fixed versions AND you have restored compressed etcd snapshots, particularly from external or untrusted sources.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade K3s to version 1.35.3+k3s1, 1.34.6+k3s1, or v1.33.10+k3s1 or later. Until patched, only restore etcd snapshots from trusted sources.

Recommended fix High confidence

K3s v1.35.3+k3s1 (or v1.34.6+k3s1 or v1.33.10+k3s1 depending on branch)

  1. Check the currently installed K3s version using: k3s --version
  2. If running a version prior to 1.35.3+k3s1, 1.34.6+k3s1, or v1.33.10+k3s1, plan for an upgrade
  3. Backup any critical etcd snapshots and K3s data before upgrading
  4. Upgrade K3s to version 1.35.3+k3s1 (latest stable fixed release) using the standard upgrade process: curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=v1.35.3+k3s1 sh -s -
  5. Alternatively, for system-specific upgrades, use the appropriate package manager or k3s-install.sh script with the fixed version
  6. After upgrade, verify the new version is running: k3s --version
  7. Test etcd snapshot restore functionality to confirm the vulnerability is patched
Caveat Review K3s release notes for any breaking changes between your current version and the target version; minor version upgrades within the same branch typically have lower risk

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-54250 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-54250 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data