Path traversal in saltstack

GHSA-2qw3-2wv6-p64x · CVE-2024-22232 · PYSEC-2026-1891

Published Jun 27, 2024 · Modified Jul 7, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

A specially crafted url can be created which leads to a directory traversal in the salt file server.
A malicious user can read an arbitrary file from a Salt master’s filesystem.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-22232
WEB https://github.com/saltstack/salt/commit/e0cdb80b55123f4a024759ffcf2b3f0e0788e7ab
PACKAGE https://github.com/saltstack/salt
WEB https://saltproject.io/security-announcements/2024-01-31-advisory

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Path traversal in saltstack

Description

References

More PyPI vulnerabilities

Start Securing