A path traversal vulnerability exists when the kubectl cp command is used on Windows. The client builds a tar archive inside the container, streams it over the network, and extracts it on the local host. If the tar binary inside the container is compromised, it can execute arbitrary code and produce unexpected output. An attacker who controls the content of the container can exploit this to write files to any location reachable by the local Windows user, effectively enabling arbitrary file overwrites. The weakness is classified under CWE-22.

The issue impacts all Kubernetes kubectl clients running on Windows. Every installed version that implements the cp sub-command is potentially vulnerable; no specific product or version range is identified in the advisory. The problem is limited to Windows clients and does not affect Unix-style kubectl installations.

With a CVSS score of 6.5 the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploits yet. To exploit the flaw an attacker must control content inside a container and run kubectl cp from a Windows machine. Once invoked, the attacker can write files to arbitrary paths on the local system, subject only to the permissions held by the Windows user running kubectl.