Kaniko, a tool for building container images, improperly limits pathnames during extraction of build context archives in versions >=1.25.4 <1.25.10. It uses filepath.Join(dest, cleanedName) without ensuring the resulting path remains within the destination directory, allowing path traversal via entries like '../outside.txt'. This can lead to files being written outside the intended directory. In environments with registry authentication, this vulnerability can be chained with docker credential helpers to achieve code execution within the executor process. The vulnerability is addressed in version 1.25.10 by adopting securejoin for path resolution during tar extraction.

The vulnerability allows an attacker to write files outside the intended extraction directory during image build, which can be leveraged to execute arbitrary code within the kaniko executor process in authenticated registry environments. This elevates the risk to high severity due to potential code execution and integrity compromise of the build environment.

A fixed version, 1.25.10, is available that addresses this vulnerability by using secure path resolution. Users should upgrade to version 1.25.10 or later to remediate this issue. There is no indication that temporary mitigations or workarounds are provided by the vendor. Patch status is confirmed by the vendor advisory.