Every CVE Search/ Get API key

CVE-2015-5305

Directory Traversal in Kubernetes

6.4 MediumFix available

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

Exploit likelihood

1.85%Up 1.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.4

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

Record
CVE-2015-5305
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

Record
CVE-2015-5305
Updated
2026-11-02
EUVDEUVD-2022-1078 No score

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

Record
EUVD-2022-1078
Updated
2026-11-03
GitHub AdvisoriesGHSA-jp32-vmm6-3vf5 6.5

Directory Traversal in Kubernetes

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

Record
GHSA-jp32-vmm6-3vf5
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-jp32-vmm6-3vf5 6.5

Directory Traversal in Kubernetes

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

Record
GHSA-jp32-vmm6-3vf5
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
OSVGO-2022-0701 No score

Directory traversal in k8s.io/kubernetes

Crafted object type names can cause directory traversal in Kubernetes.

Object names are not validated before being passed to etcd. This allows attackers to write arbitrary files via a crafted object name, hence causing directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0.

Record
GO-2022-0701
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/kubernetes/kubernetes
Go
before 1.1.1
1.1.1
k8s.io/kubernetes
Go
before 1.1.1
1.1.1
openshift
Red Hat:openshift:3.0::el7
before 0:3.0.2.0-0.git.20.656dc3e.el7ose
0:3.0.2.0-0.git.20.656dc3e.el7ose
openshift-clients
Red Hat:openshift:3.0::el7
before 0:3.0.2.0-0.git.20.656dc3e.el7ose
0:3.0.2.0-0.git.20.656dc3e.el7ose
openshift-master
Red Hat:openshift:3.0::el7
before 0:3.0.2.0-0.git.20.656dc3e.el7ose
0:3.0.2.0-0.git.20.656dc3e.el7ose
openshift-node
Red Hat:openshift:3.0::el7
before 0:3.0.2.0-0.git.20.656dc3e.el7ose
0:3.0.2.0-0.git.20.656dc3e.el7ose
openshift-sdn-ovs
Red Hat:openshift:3.0::el7
before 0:3.0.2.0-0.git.20.656dc3e.el7ose
0:3.0.2.0-0.git.20.656dc3e.el7ose
tuned-profiles-openshift-node
Red Hat:openshift:3.0::el7
before 0:3.0.2.0-0.git.20.656dc3e.el7ose
0:3.0.2.0-0.git.20.656dc3e.el7ose

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5305 is a medium vulnerability (CVSS 6.4) in Redhat Openshift, published November 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in github.com/kubernetes/kubernetes 1.1.1.

References

Show 8 moreShow less
MoveEnter Open