PUBLISHED
2026-04-09 21:16
MODIFIED
2026-04-09 21:16
EPSS (Prob. Exploit)
0.21%
Top 89.2%
> DESCRIPTION
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CVSS V3 METRICS
CVSS_VECTOR
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
> MÉTRIQUES CVSS DÉTAILLÉES
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
| Métrique |
Valeur |
Interprétation |
|
AV (Vecteur d'Attaque)
Attack Vector
|
Local (L)
|
Exploit nécessite un accès local au système
|
|
AC (Complexité d'Attaque)
Attack Complexity
|
Low (L)
|
Peu de conditions requises pour exploiter
|
|
PR (Privilèges Requis)
Privileges Required
|
None (N)
|
Aucune authentification requise
|
|
UI (Interaction Utilisateur)
User Interaction
|
Unknown (P)
|
Interaction inconnue
|
|
S (Périmètre)
Scope
|
Unchanged (U)
|
Impact reste dans le périmètre du composant compromis
|
|
C (Impact Confidentialité)
Confidentiality Impact
|
None (N)
|
Aucune divulgation d'informations
|
|
I (Impact Intégrité)
Integrity Impact
|
Low (L)
|
Modification limitée des données possible
|
|
A (Impact Disponibilité)
Availability Impact
|
Low (L)
|
Interruption partielle du service possible
|
> RÉSUMÉ DES IMPACTS
Confidentialité
None
Aucune divulgation d'informations
Intégrité
Low
Modification limitée des données possible
Disponibilité
Low
Interruption partielle du service possible
> CWE DETAILED DESCRIPTIONS
CWE-22: Improper Limitation of a Pathname to a Restricted Directory - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
> RED HAT SECURITY ADVISORIES
Red Hat Security Advisory: Helm CLI v4.1.4 release
General availability release of Helm CLI v4.1.4.
Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.9 security update
Red Hat Advanced Cluster Management for Kubernetes 2.13 General
Availability release images, which add new features and enhancements, bug
fixes, and updated container images.
Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.8 security update
The multicluster engine for Kubernetes 2.8 General Availability release images,
which add new features and enhancements, bug fixes, and updated container images.
> RED HAT SEVERITY ASSESSMENT
> GITHUB SECURITY ADVISORY
GHSA-hr2v-4r36-88hr
MODERATE
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
AFFECTED PACKAGES:
GO / helm.sh/helm/v3
<= 3.20.1
Fixed in: 3.20.2
GO / helm.sh/helm/v4
<= 4.1.3
Fixed in: 4.1.4
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
AFFECTED PACKAGES:
Unknown / Unknown
40 versions affected
ALIASES:
BIT-helm-2026-35206, GHSA-hr2v-4r36-88hr, GO-2026-5435
> HISTORIQUE DES MODIFICATIONS
Première apparition
09/04/2026 21:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - The product uses external input to construct a pathname that is intended to identify a file or directory that i...
Nouvelle valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneat...
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - The product uses external input to construct a pathname that is intended to identify a file or directory that i...
📊
ENRICHISSEMENT
12/04/2026 05:01
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 23:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 22:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 21:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 20:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 19:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 18:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 17:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 16:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 15:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 14:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 13:30
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 12:30
REDHAT
Champ modifié: Sévérité Red Hat
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
10/04/2026 12:30
REDHAT
Total des modifications: 16
Dernière mise à jour: 1 week ago