CVE-2021-20218: Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client
Summary
CVE-2021-20218: Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client. Affects io.fabric8:kubernetes-client across 4 version ranges.
>= 4.2.0, < 4.7.2
>= 4.8.0, < 4.11.2
>= 4.12.0, < 4.13.2
>= 5.0.0, < 5.0.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fabric8 kubernetes-client is a Maven package that provides a Java client library for interacting with the Kubernetes API. It allows developers to manage Kubernetes resources, such as pods, services, and deployments, programmatically. The fabric8 kubernetes-client is widely used in applications that leverage Kubernetes for container orchestration and management. However, a vulnerability has been discovered in versions 4.2.0 and later, which could allow a malicious pod or container to extract files outside the intended working path when using the copy command. This vulnerability poses a high risk to the integrity and availability of affected systems.
Vulnerability Detail
The vulnerability in the fabric8 kubernetes-client arises from an improper limitation of a pathname to a restricted directory. By exploiting this flaw, a malicious pod or container can manipulate the copy command to extract files from locations outside the intended working path. This could lead to unauthorized access to sensitive files, potential data breaches, and the execution of arbitrary code. The vulnerability has been assigned a CVSS score of 7.4, indicating a high severity level.
How To Fix
Latest published version: 8.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.7.24.7.2 -
>= 4.8.0, < 4.11.24.11.2 -
>= 4.12.0, < 4.13.24.13.2 -
>= 5.0.0, < 5.0.25.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can disable or restrict the usage of the copy command in their applications. By avoiding the use of this command, the risk of file extraction outside the working path can be mitigated. However, this workaround may impact the functionality of applications that rely on the copy command for legitimate purposes. It is recommended to apply the fix by upgrading to the patched versions as soon as possible.
Conclusion
The fabric8 kubernetes-client is vulnerable to an improper limitation of a pathname, which can be exploited by a malicious pod or container to extract files outside the intended working path. This vulnerability has a high severity level and can lead to unauthorized access, data breaches, and arbitrary code execution. It is crucial to upgrade to the patched versions of the fabric8 kubernetes-client and review any code that utilizes the copy command. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.fabric8:kubernetes-client →
FAQ
The fabric8 kubernetes-client is a Java client library for interacting with the Kubernetes API. It allows developers to manage Kubernetes resources programmatically.
This vulnerability allows a malicious pod or container to extract files outside the intended working path, potentially leading to unauthorized access, data breaches, and arbitrary code execution.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
To fix this vulnerability, upgrade to one of the patched versions of the fabric8 kubernetes-client: kubernetes-client-4.13.2, kubernetes-client-5.0.2, kubernetes-client-4.11.2, or kubernetes-client-4.7.2.
As a temporary workaround, you can disable or restrict the usage of the copy command in your applications. However, it is recommended to apply the fix by upgrading to the patched versions.
Related vulnerabilities
Recent vulnerabilities recorded for io.fabric8:kubernetes-client.
