The CTFer.io Monitoring component suffers from an Archive Slip (path traversal) due to a missing trailing path separator in the sanitizeArchivePath function. The flaw allows an attacker to craft an extraction that writes arbitrary files, potentially overwriting critical system files such as SSH keys, kubeconfig, shell configs, or crontabs. This gives the attacker a path to remote code execution and persistent backdoors in the cluster environment. The vulnerability is classified as CWE-22.

Affected only the ctfer-io:monitoring product. All releases before version 0.2.2 are impacted, including 0.2.1 and earlier. No specific subversion list is available, but any build prior to 0.2.2 is vulnerable.

The vulnerability has a CVSS v3.1 score of 8.8, indicating high severity. EPSS data is not available, and the flaw is not currently listed in the CISA KEV catalog. Exploitation requires a pod with the default ReadWriteMany PVC access mode, allowing injection of malicious payloads. Attackers leveraging any pod in the cluster can exploit the flaw, and the lack of checks in the extraction process means the path traversal can be performed without additional privilege escalation.