Description
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.
Published: 2026-09-14
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Description DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.
Title DevSpace through 6.3.21 Path Traversal via tar extraction
First Time appeared Devspace
Devspace devspace
Weaknesses CWE-22
CPEs cpe:2.3:a:devspace:devspace:*:*:*:*:*:*:*:*
Vendors & Products Devspace
Devspace devspace
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Devspace Devspace
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-14T22:10:57.135Z

Reserved: 2026-09-14T21:55:43.719Z

Link: CVE-2026-91200

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-14T23:19:00.630

Modified: 2026-09-14T23:19:00.630

Link: CVE-2026-91200

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')