The vulnerability arises from an improper limitation of a pathname to a restricted directory, known as path traversal (CWE-22). An authorized attacker can supply a crafted path that bypasses directory restrictions, enabling local execution of arbitrary code on the Azure Kubernetes Service host. This flaw directly leads to remote code execution, compromising the integrity and confidentiality of the cluster and potentially all workloads it hosts.

The flaw affects Microsoft Azure Kubernetes Service deployments. No specific version information is disclosed in the advisory, so all current AKS clusters may be vulnerable until Microsoft releases a patch.

The reference CVSS score of 8.8 classifies this as a high severity vulnerability. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting limited prior exploitation. However, the flaw requires an attacker to already possess authorized access to the AKS environment, so the attack vector is internal or compromised account. Attackers could trigger the path traversal to move to privileged directories and execute code, potentially leading to full cluster compromise.