PT-2026-22407 · Google · Kaniko
1Seal
·
Published
2026-02-27
·
Updated
2026-03-25
·
CVE-2026-28406
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
kaniko versions 1.25.4 through 1.25.9
Description
kaniko is a tool used to build container images from a Dockerfile within a container or Kubernetes cluster. Versions from 1.25.4 up to, but not including, 1.25.10 improperly handle the extraction of build context archives. Specifically, the function
filepath.Join(dest, cleanedName) does not adequately restrict the extracted files to the intended destination directory (dest). This allows a malicious archive to include entries like ../outside.txt which can escape the extraction root and write files outside the designated directory. In environments where registry authentication is enabled, this can potentially lead to code execution within the kaniko executor process by chaining this issue with docker credential helpers.Recommendations
Update to kaniko version 1.25.10 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kaniko