CVE-2019-11246 — kubectl cp allows symlink directory traversal

Back Back to CVE browser

MEDIUM

kubectl cp allows symlink directory traversal

Published Aug 29, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 3.63%

Description

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.12.9, versions prior to 1.13.6, versions prior to 1.14.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11.

Affected products

Vendor Kubernetes Product Kubernetes Default
n/a
- Version
  1.1
  Status
  affected
  Constraints
  -
- Version
  1.10
  Status
  affected
  Constraints
  -
- Version
  1.11
  Status
  affected
  Constraints
  -
- Version
  1.2
  Status
  affected
  Constraints
  -
- Version
  1.4
  Status
  affected
  Constraints
  -
- Version
  1.5
  Status
  affected
  Constraints
  -
- Version
  1.6
  Status
  affected
  Constraints
  -
- Version
  1.7
  Status
  affected
  Constraints
  -
- Version
  1.8
  Status
  affected
  Constraints
  -
- Version
  1.9
  Status
  affected
  Constraints
  -
- Version
  prior to 1.12.9
  Status
  affected
  Constraints
  -
- Version
  prior to 1.13.6
  Status
  affected
  Constraints
  -
- Version
  prior to 1.14.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kubernetes

n/a

Version	Status	Constraints
1.1	affected	-
1.10	affected	-
1.11	affected	-
1.2	affected	-
1.4	affected	-
1.5	affected	-
1.6	affected	-
1.7	affected	-
1.8	affected	-
1.9	affected	-
prior to 1.12.9	affected	-
prior to 1.13.6	affected	-
prior to 1.14.2	affected	-

Red Hat OpenShift Container Platform 3.10

atomic-openshift-0:3.10.149-1.git.0.05de590.el7

Fixed · RHSA-2019:1632
Red Hat OpenShift Container Platform 3.11

atomic-openshift-0:3.11.117-1.git.0.14e54a3.el7

Fixed · RHSA-2019:1633
Red Hat OpenShift Container Platform 3.9

atomic-openshift-0:3.9.89-1.git.0.9454f2a.el7

Fixed · RHSA-2019:1852
Red Hat OpenShift Container Platform 3.6

atomic-openshift

Not affected
Red Hat OpenShift Container Platform 3.7

atomic-openshift

Not affected
Red Hat OpenShift Container Platform 4

openshift

Not affected
Red Hat Storage 3

heketi

Will not fix

Product	Package	State	Advisory
Red Hat OpenShift Container Platform 3.10	atomic-openshift-0:3.10.149-1.git.0.05de590.el7	Fixed	RHSA-2019:1632
Red Hat OpenShift Container Platform 3.11	atomic-openshift-0:3.11.117-1.git.0.14e54a3.el7	Fixed	RHSA-2019:1633
Red Hat OpenShift Container Platform 3.9	atomic-openshift-0:3.9.89-1.git.0.9454f2a.el7	Fixed	RHSA-2019:1852
Red Hat OpenShift Container Platform 3.6	atomic-openshift	Not affected	n/a
Red Hat OpenShift Container Platform 3.7	atomic-openshift	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift	Not affected	n/a
Red Hat Storage 3	heketi	Will not fix	n/a

Remediation

No remediation recorded yet.

Metrics

3.63% 0.03633

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.03633

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	3.63% (0.03633)	89.19th	v5 (v2026.06.15)
Jun 15, 2026	3.62% (0.03616)	87.98th	v5 (v2026.06.15)
Mar 30, 2025	1.60% (0.01602)	80.03th	v4 (v2025.03.14)
Mar 29, 2025	17.15% (0.17146)	91.73th	v4 (v2025.03.14)
Mar 17, 2025	1.60% (0.01602)	80.44th	v4 (v2025.03.14)
Jul 20, 2024	0.11% (0.00115)	45.72th	v3 (v2023.03.01)
Nov 8, 2023	0.11% (0.00115)	45.09th	v3 (v2023.03.01)
Mar 7, 2023	0.08% (0.00081)	32.95th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	3.28% (0.03283)	65.67th	v2 (v2022.01.01)
Feb 3, 2022	1.96% (0.01960)	50.07th	v1
Jan 6, 2022	1.96% (0.01960)	49.57th	v1
Sep 1, 2021	0.44% (0.00444)	27.89th	v1
Apr 14, 2021	0.44% (0.00444)	0.00th	v1

Weaknesses (3)

CWE-22

Path Traversal

CWE-59

CWE-61

References (8)

https://access.redhat.com/security/cve/CVE-2019-11246
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1721704
Issue Tracking
https://github.com/kubernetes/kubernetes/pull/76788
x_refsource_CONFIRMPatchThird Party Advisory
https://groups.google.com/forum/#!topic/kubernetes-dev/OxFMDVnqk60
https://groups.google.com/forum/#%21topic/kubernetes-security-announce/NLs2TGbfPdo
mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2019-11246
https://security.netapp.com/advisory/ntap-20190919-0003/
x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-11246

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-11246		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1721704		Issue Tracking
https://github.com/kubernetes/kubernetes/pull/76788		x_refsource_CONFIRMPatchThird Party Advisory
https://groups.google.com/forum/#!topic/kubernetes-dev/OxFMDVnqk60
https://groups.google.com/forum/#%21topic/kubernetes-security-announce/NLs2TGbfPdo		mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2019-11246
https://security.netapp.com/advisory/ntap-20190919-0003/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-11246