title: Kubernetes Java client libraries unvalidated path traversal in Copy implementation
description: Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
problem types: CWE-23 Relative Path Traversal
affected:
{
product: Kubernetes Java Client
vendor: Kubernetes
versions:
status: affected, version: all versions prior to 9.0
lessThan: 9.0.2, status: affected, version: 9.0, versionType: custom
lessThan: 10.0.1, status: affected, version: 10.0, versionType: custom
}
solutions: Upgrade to 9.0.2, 10.0.1 or 11.0.0 versions of the library.