CVE-2026-62369: KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

## Description KubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory. The issue is particularly relevant to Windows edge nodes during the `keadm join` or installation process when `keadm` extracts downloaded component archives. ## Impact An attacker who can cause an affected `keadm` process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running `keadm`. On Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the `keadm` process, successful exploitation could lead to persistent system modification or code execution. Exploitation requires the attacker to influence the contents of an archive processed by `keadm`, such as through a compromised, replaced, or otherwise untrusted download source. ## Patches The extraction logic now: * resolves the destination directory to an absolute path; * rejects empty archive entry names; * normalizes Windows-style path separators before validation; * rejects parent-directory traversal paths; * rejects absolute and Windows drive-prefixed paths; * uses `filepath-securejoin` to ensure extracted files remain within the destination directory. Fixes are planned for the following maintained releases: * v1.23.1 * v1.22.2 * v1.21.2 ## Workarounds Until a patched release is available: * only install or join edge nodes using trusted KubeEdge package sources; * verify the integrity and origin of downloaded archives before extraction; * do not use custom or untrusted component archives with `keadm`; * restrict write permissions and administrative privileges for the account running `keadm`; * avoid performing Windows edge-node installation or join operations when the package source cannot be trusted. ## Credits KubeEdge thanks Sang-Hoon Choi ([KoreaSecurity](https://github.com/KoreaSecurity), Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.