CVE-2020-4053

—

CVSS 3.1

6.8 medium

EPSS

1%p72

Published

Jun 16, 2020 (Jun 16, 2020)

Modified

Jun 17, 2026

Description

In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a file outside of the intended directory. This has been fixed in 3.2.4.

Vendors: helm
Products: helm
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.