Vulnerability Description
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/devspace-sh/devspace
- https://github.com/devspace-sh/devspace/blob/7f272dcf90653fa9b42bc4347f7f3f9a52b
- https://github.com/devspace-sh/devspace/blob/7f272dcf90653fa9b42bc4347f7f3f9a52b
- https://github.com/devspace-sh/devspace/issues/3290
- https://www.vulncheck.com/advisories/devspace-through-6.3.21-path-traversal-via-
FAQ
What is CVE-2026-91200?
CVE-2026-91200 is a vulnerability with a CVSS score of 8.8 (HIGH). DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequen...
How severe is CVE-2026-91200?
CVE-2026-91200 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-91200?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.