A vulnerability has been discovered in kubectl cp that allows a combination of two symlinks to copy a file outside of its destination directory. This could be used to allow an attacker to place a netfarious file using a symlink, outside of the destination tree.

Reference: https://github.com/kubernetes/kubernetes/pull/82143 https://github.com/kubernetes/kubernetes/pull/82143 https://github.com/kubernetes/kubernetes/pull/82384 https://github.com/kubernetes/kubernetes/pull/82502 https://github.com/kubernetes/kubernetes/pull/82503