[kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes

CVE-2026-19444 is a path traversal flaw (CWE-22) in the Kubernetes kubectl cp command, and it affects only kubectl clients running on Windows. When a user copies files out of a container, kubectl runs tar inside that container, transfers the archive, and unpacks it locally; a malicious tar binary controlled by an attacker who owns the container contents can emit crafted output that writes files to arbitrary paths on the user's machine, limited only by that local user's permissions. Triggering it requires the victim to invoke kubectl cp (user interaction) against a container the attacker already controls, with adjacent-network access and high privileges in the CVSS scoring (6.5 medium; integrity impact is high, confidentiality low, availability unchanged). Windows users of kubectl who copy from untrusted containers are the affected population; Linux and macOS clients are not affected. There is no known public proof of concept and the CVE is not listed in CISA KEV, so exploitation is none known.