Read the docs
TI-2020-03542 Aliases CVE-2020-4053GHSA-qq3j-xp49-j73f

Path Traversal in Helm Plugin Archive

Priority LOW 33CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a file outside of the intended directory. This has been fixed in 3.2.4.

Why it matters now

EPSS 0.01458 73rd percentileScored 2026-11-07
Fix Fixed Helm (The Helm Project): 3.2.4helm.sh/helm/v3 (Go): 3.2.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Helm ProjectHelm3.0.0 to before 3.2.43.2.4Patch availableCNA
—helm.sh/helm/v3 (Go)3.0.0 to before 3.2.43.2.4Patch availableGHSA-qq3j-xp49-j73f
  • Helm VendorThe Helm Project Affected 3.0.0 to before 3.2.4 Fixed in 3.2.4 Patch available CNA
  • helm.sh/helm/v3 (Go) Vendor— Affected 3.0.0 to before 3.2.4 Fixed in 3.2.4 Patch available GHSA-qq3j-xp49-j73f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*3.0.0 to before 3.2.4Vulnerablehelm
  • cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.2.4 Vulnerable ·helm

Remediation

  • Fix · CNA Helm (The Helm Project) Fixed in 3.2.4
  • Fix · GHSA-qq3j-xp49-j73f helm.sh/helm/v3 (Go) Fixed in 3.2.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenStack Platform 16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-4053
  2. 2026-10-03 Alias added: GHSA-qq3j-xp49-j73f

References

Patch 1

Advisory 2

Other 3

  • TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
  • TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
  • TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
  • TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
  • TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences