Path Traversal

salt is vulnerable to Path Traversal. The vulnerability is caused by roots.py because there is no explicit path validation before performing file operations, as well as master.py creating directories and files based on unvalidated user input. An attacker can exploit these flaws to traverse and manipulate the file system outside of the intended boundaries.