kubectl cp allows symlink directory traversal

The kubectl cp command in Kubernetes can be tricked by a malicious container to write files outside the intended destination folder using symlinks. An attacker could exploit this to place harmful files in unexpected locations on your system.

The kubectl cp command fails to properly validate symlinks in tar archives from container output, allowing directory traversal via chained symlinks. An attacker controlling a container can craft tar output with symlinks that bypass destination directory restrictions, enabling arbitrary file placement on the host running kubectl.