Path Traversal

2024-02-1507:16:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

vulnerability

path traversal

validation

linting

client

sdk

relative paths

chart.yaml

manipulation

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Score

6.9

Confidence

High

EPSS

Percentile

10.5%

JSON

github.com/helm/helm is vulnerable to Path Traversal. This vulnerability is due to a flaw in the validation and linting process within the client and SDK, allowing the saving of charts outside their expected directory based on changes in relative paths specified in the Chart.yaml file. An attacker can exploit this vulnerability to manipulate chart paths, resulting in Path traversal.