K3s versions prior to 1.35.3+k3s1, 1.34.6+k3s1, and v1.33.10+k3s1 contain a path traversal vulnerability (CWE-22) in the etcd snapshot decompression functionality. When an administrator restores an etcd snapshot from a compressed archive, specially crafted zip files with malicious file names can cause files to be extracted outside the intended directory, potentially overwriting arbitrary files on the filesystem. This vulnerability is addressed in the fixed versions listed.

An attacker with the ability to provide a malicious etcd snapshot archive to an administrator performing a restore can cause arbitrary files to be written to the filesystem. This can lead to integrity violations and denial of service. The CVSS score of 5.8 reflects a medium severity with high impact on integrity and availability, requiring local privileges with high user interaction.

Upgrade to k3s versions 1.35.3+k3s1, 1.34.6+k3s1, or v1.33.10+k3s1 or later, where this path traversal vulnerability is fixed. Until upgraded, avoid restoring etcd snapshots from untrusted or unauthenticated sources to prevent exploitation.