A third issue was discovered with the Kubernetes kubectl cp command that could enable a directory traversal such that a malicious container could replace or create files on a user’s workstation. The vulnerability is a client-side defect and requires user interaction to be exploited.

This vulnerability allows a malicious container to cause a file to be created or replaced on the client computer when the client uses the kubectl cp operation. The vulnerability is a client-side defect and requires user interaction to be exploited.

Upstream Issue:

https://github.com/kubernetes/kubernetes/issues/80984

External References:

https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc