The bug lies in the copyDirectoryFromPod method when tar compression is disabled. It allows a pod that has been compromised or is malicious to write files to any location relative to the client’s working directory, effectively performing a local path traversal. The vulnerability is a CWE‑22 type flaw and could let an attacker overwrite system files or write arbitrary data, impacting confidentiality, integrity, and availability of the client machine.

Affected systems include any application that imports the Kubernetes Java client library and calls copyDirectoryFromPod with enableTarCompressing set to false. This encompasses custom controllers, operators, or any client‑side tooling that interacts with pod file systems. No specific product versions are listed, so the risk applies broadly to all builds that use the vulnerable method.

The CVSS score of 2.7 rates the flaw as low severity and the EPSS score of less than 1% indicates a low probability of exploitation. The bug is not part of the CISA KEV catalog. The typical attack requires a compromised pod that invokes the insecure copy path; as a result, the attacker can write files on the client when that client initiates the copy. The mitigation is available through a workaround that restricts pod trust or enables the tar‑based copy route.