-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.fabric8:kubernetes-client | maven | >= 4.2.0, <= 4.7.1 | 4.7.2 |
| io.fabric8:kubernetes-client | maven | >= 4.8.0, <= 4.11.1 | 4.11.2 |
| io.fabric8:kubernetes-client | maven | >= 4.12.0, <= 4.13.1 | 4.13.2 |
| io.fabric8:kubernetes-client | maven | >= 5.0.0, <= 5.0.1 | 5.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability manifests in the tar entry processing loop where file paths were constructed directly from untrusted archive entry names. The patch adds normalization via FilenameUtils.normalize() to prevent path traversal. The anonymous Runnable's run() method in PodOperationsImpl contained the unvalidated path construction, making it the vulnerable execution point visible in profilers when extracting malicious archives.
Ongoing coverage of React2Shell