Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in

CVE-2021-25282

🗓️ 27 Feb 2021 00:00:00Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 339 Views

An issue discovered in SaltStack Salt before 3002.5, salt.wheel.pillar_roots.write method directory traversal vulnerability

Related
Detection
Refs
Social
ReporterTitlePublishedViews
Family
zdt
zdt		SaltStack Salt API Unauthenticated Remote Command Execution Exploit
2 Apr 202100:00
–zdt
freebsd
FreeBSD		salt -- multiple vulnerabilities
25 Feb 202100:00
–freebsd
attackerkb
attackerkb		CVE-2021-25282
27 Feb 202105:15
–attackerkb
alpinelinux
AlpineLinux		CVE-2021-25282
27 Feb 202100:00
–alpinelinux
archlinux
ArchLinux		[ASA-202102-33] salt: multiple issues
27 Feb 202100:00
–archlinux
bdu_fstec
BDU FSTEC		salt.wheel.pillar_roots.write Disclosure Sensitive Information
30 Nov 202200:00
–bdu_fstec
githubexploit
GithubExploit		Exploit for Improper Authentication in Saltstack Salt
26 Feb 202112:08
–githubexploit
circl
Circl		CVE-2021-25282
26 Feb 202110:46
–circl
cnnvd
CNNVD		Saltstack SaltStack Salt 路径遍历漏洞
26 Feb 202100:00
–cnnvd
cnvd
CNVD		SaltStack Salt Path Traversal Vulnerability
26 Feb 202100:00
–cnvd
Rows per page
NVD
Node
OR
saltstacksaltRange<2015.8.10
saltstacksaltRange2015.8.11–2015.8.13
saltstacksaltRange2016.3.0–2016.3.4
saltstacksaltRange2016.3.5–2016.3.6
saltstacksaltRange2016.3.7–2016.3.8
saltstacksaltRange2016.3.9–2016.11.3
saltstacksaltRange2016.11.4–2016.11.5
saltstacksaltRange2016.11.7–2016.11.10
saltstacksaltRange2017.5.0–2017.7.8
saltstacksaltRange2018.2.0–2018.3.5
saltstacksaltRange2019.2.0–2019.2.5
saltstacksaltRange2019.2.6–2019.2.8
saltstacksaltRange3000–3000.6
saltstacksaltRange3001–3001.4
saltstacksaltRange3002–3002.5
Node
OR
fedoraprojectfedoraMatch32
fedoraprojectfedoraMatch33
fedoraprojectfedoraMatch34
Node
OR
debiandebian_linuxMatch9.0
debiandebian_linuxMatch10.0
debiandebian_linuxMatch11.0
SourceLink
listswww.lists.debian.org/debian-lts-announce/2021/11/msg00009.html
saltprojectwww.saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
packetstormsecuritywww.packetstormsecurity.com/files/162058/SaltStack-Salt-API-Unauthenticated-Remote-Command-Execution.html
githubwww.github.com/saltstack/salt/releases
listswww.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
securitywww.security.gentoo.org/glsa/202310-22
listswww.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
listswww.lists.debian.org/debian-lts-announce/2022/01/msg00000.html
debianwww.debian.org/security/2021/dsa-5011
securitywww.security.gentoo.org/glsa/202103-01
Rows per page

CVE-2021-25281&CVE-2021-25282&CVE-2021-25283 Saltstack未授權RCE漏洞 https://t.co/gX9R4wagUR?amp=1

It is the first time for me to know a protection/signature/rule for the vulnerability CVE-2021-25282. #S22g62xucdusqo

Published a blog post with details on the Salt API vulnerabilities I found: (CVE-2021-3197, CVE-2021-25281, CVE-2021-25282)

NEW: CVE-2021-25282 An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. Severity: CRITICAL https://t.co/ODds53pAsr?amp=1

It's new to me that Hillstone has a protection/signature/rule for the vulnerability CVE-2021-25282. https://t.co/ejL8vnxxtp?amp=1 /search?src=sprv&q=CVE-2021-25282 The vuln was published 50 days ago by NIST. #S22g62xucdusqo

CVE-2021-25282 An issue was discovered in through SaltStack Salt before 3002.5. ... https://t.co/qNNvWXFDpp?amp=1 Vulnerability Alert Subscriptions: https://t.co/hrQhy5M9W5?amp=1

#CVE CVE-2021-25282 SaltStack < 3002.5 任意文件写入漏洞 PS：啥都能写进去，替换json中data内容即可

NEW: CVE-2021-25282 An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. https://t.co/ODds53pAsr?amp=1

NEW: CVE-2021-25282 An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. Severity: CRITICAL https://t.co/ODds53pAsr?amp=1

NEW: CVE-2021-25282 An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. https://t.co/ODds53pAsr?amp=1

Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 03:41Current
9.1Critical risk
Vulners AI Score9.1
CVSS 26.4
CVSS 3.19.1
EPSS0.92409
CWE-22
cve-2021-25282saltstacksaltdirectory traversalvulnerabilitynvd
339