Dependency management path traversal in helm
Priority MEDIUM 62CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 5 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the `Chart.yaml` file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Users unable to upgrade should check all charts used by Helm for path changes in their name as found in the `Chart.yaml` file. This includes dependencies.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00567 47th percentileScored 2026-11-07
Fix Partial helm (helm): 3.14.1helm.sh/helm/v3 (Go): 3.14.1Red Hat: 6 advisoriesRed Hat: 5 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| helm | helm | before 3.14.1 | 3.14.1 | Patch available | CNA |
| — | helm.sh/helm/v3 (Go) | before 3.14.1 | 3.14.1 | Patch available | GHSA-v53g-5gjp-272r |
- helm Vendorhelm Affected before 3.14.1 Fixed in 3.14.1 Patch available CNA
- helm.sh/helm/v3 (Go) Vendor— Affected before 3.14.1 Fixed in 3.14.1 Patch available GHSA-v53g-5gjp-272r
Remediation
- Fix · CNA helm (helm) Fixed in 3.14.1
- Fix · GHSA-v53g-5gjp-272r helm.sh/helm/v3 (Go) Fixed in 3.14.1 Advisory →
Red Hat 6 advisories
- RHSA-2024:3718 Released 2024-10-01 · Red Hat rating ModerateOpenShift Container Platform 4.17.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:4626 Released 2024-07-18 · Red Hat rating ModerateErrata Advisory for Red Hat OpenShift GitOps v1.11.6 security update
- Red Hat OpenShift GitOps 1.11 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 +6
- RHSA-2024:4163 Released 2024-06-27 · Red Hat rating ModerateErrata Advisory for Red Hat OpenShift GitOps v1.12.4 security update
- Red Hat OpenShift GitOps 1.12 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
Show 3 more Red Hat advisories
- RHSA-2024:2865 Released 2024-05-21 · Red Hat rating ImportantOpenShift Container Platform 4.15.14 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-aws-pod-identity-webhook-rhel9, openshift4/ose-azure-cloud-node-manager-rhel9, openshift4/ose-azure-cluster-api-controllers-rhel9 +3
- RHSA-2024:1255 Released 2024-03-19 · Red Hat rating ModerateOpenShift Container Platform 4.15.3 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-olm-rukpak-rhel8
- RHSA-2024:1328 Released 2024-03-14 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.9.3 security and bug fix container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 | Fixed | RHSA-2024:1328 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:1255, RHSA-2024:2865 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:3718 |
| Red Hat OpenShift GitOps 1.11 | Fixed | RHSA-2024:4626 |
| Red Hat OpenShift GitOps 1.12 | Fixed | RHSA-2024:4163 |
Not affected: 12 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
- Red Hat Advanced Cluster Security 3
- Red Hat Advanced Cluster Security 4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Virtualization 4
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Container Storage 4
- Red Hat Openshift Data Foundation 4
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2024-25620
- 2026-10-03 Alias added: GHSA-v53g-5gjp-272r
References
More Helm vulnerabilities
- TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
- TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
- TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
- TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
- TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
- TI-2024-17237 Helm's Missing YAML Content Leads To Panic CVSS 3.1HIGH 7.5
Sources
- CVE-2024-25620 · CVE Program
- CVE-2024-25620 · NVD
- FIRST EPSS
- GHSA-v53g-5gjp-272r · GitHub Advisory Database · CC BY 4.0
- CVE-2024-25620 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences