CVE-2026-91200: DevSpace through 6.3.21 Path Traversal via tar extraction
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DevSpaceto a version that resolves this vulnerability.Fixed in 6.3.21
Event History
Frequently Asked Questions
Which system is at risk of file overwrite during exploitation?
The affected target is the developer workstation running DevSpace. Malicious tar entries arrive through the in-pod sync stream and can write files outside the intended extraction path.
What does an attacker need to control?
The attacker needs to operate a malicious container that can provide crafted tar entries through the in-pod sync stream. The CVSS vector also indicates user interaction is required.