CVE-2025-62878: Critical Kubernetes Storage Flaw Lets Attackers Break Out of Volume Paths and Reach Host Files

CVE-2025-62878 — Local Path Provisioner Path Traversal

CVE ID: CVE-2025-62878
Affected Component: Local Path Provisioner (rancher/local-path-provisioner)
Vulnerability Type: Path Traversal
Impact Category: Arbitrary file access / host filesystem manipulation
CVSS Score: 9.9
Severity: Critical
Exploitability: High
Exploit Availability: No officially weaponized exploit framework published; however, the vulnerability is trivial to reproduce in controlled environments and must be treated as actively exploitable

Description

A path traversal vulnerability exists in the Local Path Provisioner used in Kubernetes clusters for dynamic provisioning of local PersistentVolumes. The issue is caused by insufficient validation and normalization of the parameters.pathPattern field defined in a StorageClass.

When a PersistentVolume is provisioned, the Local Path Provisioner constructs a directory path on the host node using the configured base path combined with user-supplied template values. Due to missing safeguards, directory traversal sequences such as ../ can be embedded into the path pattern. This allows the resolved path to escape the intended base directory and point to arbitrary locations on the host filesystem.

As a result, PersistentVolumes may be created in sensitive directories outside the expected storage location, exposing the underlying host to unauthorized read and write operations from containers.

Affected Versions

All versions of Local Path Provisioner prior to 0.0.34

Attack Prerequisites

Ability to create or modify a StorageClass resource in the Kubernetes cluster
Local Path Provisioner deployed and actively used for PersistentVolume provisioning
A node where the provisioner has permission to create directories on the host filesystem

Clusters with overly permissive RBAC policies are particularly exposed.

Exploitation Details

The vulnerability is exploited by crafting a malicious StorageClass definition with a manipulated parameters.pathPattern. By including relative traversal tokens, the calculated host path resolves outside the intended directory structure.

Example Exploitation Flow (Educational)

A StorageClass is created with a pathPattern containing directory traversal sequences such as ../../.
A PersistentVolumeClaim is submitted using this StorageClass.
The Local Path Provisioner expands the template and creates the resolved directory on the host.
The resulting PersistentVolume references a host path outside the approved storage base.
Any pod mounting this volume gains access to the targeted host directory.

This can lead to:

Reading sensitive host files
Overwriting system configuration
Dropping malicious binaries on the node
Potential escalation to full node compromise when chained with other weaknesses

Proof of Concept Status

Public advisories confirm the vulnerability, and reproducible test cases are feasible in lab environments. While no large-scale exploitation campaigns have been publicly documented, the simplicity of the attack path makes exploitation highly realistic.

Proof-of-concept demonstrations typically involve:

Creating a malicious StorageClass
Triggering volume provisioning
Verifying that directories are created outside the expected base path on the node

These activities should only be performed in isolated test environments for defensive research and validation.

Impact

Confidentiality: High — sensitive host files may be exposed
Integrity: High — arbitrary host files can be modified or overwritten
Availability: High — system files or disks may be corrupted, leading to node instability

MITRE ATT&CK Mapping

Resource Manipulation: Abuse of Kubernetes control plane objects
Privilege Escalation: Gaining access to host filesystem through containerized workloads
Defense Evasion: Using legitimate Kubernetes provisioning mechanisms
Impact: Data destruction, host compromise

Detection Guidance

Relevant Log Sources

Kubernetes API server audit logs
Kubernetes events
Local Path Provisioner pod logs
Node-level filesystem and audit logs
CI/CD or Git repositories containing Kubernetes manifests

Detection Rules and Queries

Kubernetes Audit Logs — StorageClass Manipulation

index=kube_audit
object_kind=StorageClass
(action=CREATE OR action=UPDATE)
| search requestObject.parameters.pathPattern="*..*"
| table _time, user, sourceIPs, requestObject.parameters.pathPattern

Elasticsearch / OpenSearch Query

kubernetes.audit.object_kind:"StorageClass" AND
kubernetes.audit.requestObject.parameters.pathPattern:*..*

Kubernetes Resource Inspection

kubectl get storageclass -o yaml | grep -E "pathPattern:.*\.\."

PersistentVolume Host Path Review

kubectl get pv -o jsonpath='{range .items[*]}{.metadata.name}{" -> "}{.spec.local.path}{"\n"}{end}'

Review output for paths referencing system directories such as /etc, /root, /var, or other non-standard locations.

Provisioner Pod Logs

kubectl logs -n local-path-provisioner -l app=local-path-provisioner | grep -i path

Look for unexpected resolved paths or errors related to directory creation.

Node-Level Filesystem Indicators

Recently created directories in sensitive locations
PVC-related directory names appearing outside the expected storage base
Unusual file timestamps correlated with PVC creation events

Mitigation and Hardening

Immediate Actions

Upgrade Local Path Provisioner to a fixed version

Official patch / upgrade link:
https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.34

Additional Defensive Measures

Restrict StorageClass creation and modification to cluster administrators only
Implement validating admission controls to block traversal patterns in pathPattern
Enable and retain Kubernetes audit logs
Periodically review PersistentVolumes and host paths
Apply node hardening and filesystem monitoring

Risk Assessment

This vulnerability represents a direct bridge between Kubernetes configuration control and host-level filesystem access. In environments where developers or automated systems are allowed to define StorageClasses, the risk is considered severe. Prompt patching combined with RBAC tightening is strongly recommended.

Final Takeaway

All exploitation details and examples are provided strictly for educational, defensive, and risk-assessment purposes. Testing should only be performed in controlled, non-production environments.