A high-severity path traversal vulnerability in KubeEdge allows unauthenticated attackers to achieve arbitrary file overwrite and potential code execution on Windows edge nodes.

The vulnerability exists in the DecompressTarGz function within the keadm utility, which fails to properly validate archive entry names. An unauthenticated attacker providing a malicious archive can perform path traversal, escaping the intended destination directory to overwrite critical system configuration or executable files on Windows hosts.

The ability to overwrite arbitrary files on a system hosting edge orchestration infrastructure poses a significant risk to the integrity and availability of the edge environment. Successful exploitation can lead to full system compromise, unauthorized persistence, or the execution of malicious code, potentially disrupting critical operations and necessitating extensive incident response efforts. With a CVSS score of 8.1, this vulnerability is classified as high severity, reflecting the potential for significant impact on system security.

Immediate Action: Upgrade KubeEdge installations to versions 1.21.2, 1.22.2, or 1.23.1 immediately to resolve the path validation flaw.

Proactive Monitoring: Review system logs on Windows edge nodes for unusual file modification activity or attempts to execute unrecognized binaries within the KubeEdge installation directory.

Compensating Controls: Ensure that all software or archives deployed via keadm are sourced from trusted, verified repositories and implement strict filesystem permissions to limit the impact of potential file-write operations.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for arbitrary file overwrite and system compromise, organizations running KubeEdge on Windows nodes must prioritize this update. Applying the provided patches is the only effective way to prevent exploitation of this path traversal mechanism. Ensure that deployment pipelines are updated to reference the corrected versions to maintain a secure edge orchestration environment.