When Copy Means Compromise: How kubectl cp Enables RCE on Windows

**kubectl cp on Windows can be abused for remote code execution:** A path-validation bug in kubectl's archive unpacking ignores Windows-style backslash traversal, allowing a compromised pod to craft tar entries that write executables (for example into the user's Startup folder) on the client. Administrators and Windows CI/CD runners copying files from untrusted pods should assume exposure and upgrade to kubectl 1.34.12, 1.35.9, or 1.36.5+ as immediate remediation.