Database/Container, Kubernetes & orchestration
Helm: Relative path in a chart name writes the chart outside the intended directory
CVSS 6.4CVE-2024-25620Container, Kubernetes & orchestrationcurated
Impact
Relative path in a chart name writes the chart outside the intended directory
Who can reach it
Malicious chart
What to do
Upgrade Helm on CI and operator machines
References
Related entries
- Helm: Improper certificate validation allows unauthorized clients to connect to TillerCVE-2019-1010275 · HelmCritical
- Helm: Malicious chart includes sensitive host content such as /etc/passwd, or triggers DoS, when loadedCVE-2019-18658 · HelmCritical
- Helm: The `lookup` template function discloses in-cluster resources, including Secrets, to a chart authorCVE-2020-11013 · HelmHigh
- Helm: Crafted Chart.yaml plus a symlinked Chart.lock gives local code execution when dependencies are updatedCVE-2025-53547 · HelmHigh
- Helm: Crafted plugin writes its contents to an arbitrary filesystem location on install or updateCVE-2026-35204 · HelmHigh
- Helm: Helm installs plugins with no provenance file even when signature verification is requiredCVE-2026-35205 · HelmHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.