CVE-2026-54250

2 advisories.

Go/github.com/k3s-io/k3s CVE-2026-54250: medium 5.8, EPSS 0.17%

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Action: Upgrade github.com/k3s-io/k3s to 1.33.10 or later.

go get github.com/k3s-io/k3s@v1.35.3

go get github.com/k3s-io/k3s@v1.34.6

go get github.com/k3s-io/k3s@v1.33.10

Affected

introduced	fixed	last affected
1.35.0-rc1	1.35.3	-
1.34.0-rc1	1.34.6	-
0	1.33.10	-

Fixed versions

1.35.3

1.34.6

1.33.10

Sources

CVE-2026-54250 · published 2026-07-14T17:54:14Z · modified 2026-09-10T03:50:52.566036718Z · JSON

Go/github.com/k3s-io/k3s CVE-2026-54250: unknown, EPSS 0.17%

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s

Action: No fix published. Pin and monitor.

Affected

introduced	fixed	last affected
0	-	-

Fixed versions

No fixed version in the source.

Sources

CVE-2026-54250 · published 2026-07-17T19:42:05Z · modified 2026-07-28T21:00:01.782495046Z · JSON