{"id":"CVE-2019-1000008","aliases":["EUVD-2022-5856","GHSA-xrxm-mvqm-r553","GO-2023-1948"],"status":"published","title":"Helm Path Traversal","description":"All versions of Helm between Helm \u003e=2.0.0 and \u003c 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01483,"percentile":0.74345,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2019-02-04T21:00:00Z","modified":"2026-10-24T10:30:18Z","fixes":[{"ecosystem":"Go","package":"helm.sh/helm","fixed_in":["2.12.2","2.12.2+incompatible"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"helm.sh/helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.12.2"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.12.2"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0+incompatible"},{"fixed":"2.12.2+incompatible"}]}]}],"products":[{"vendor":"helm","product":"helm"}],"references":[{"url":"https://helm.sh/blog/helm-security-notice-2019/index.html","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Vendor Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1000008","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xrxm-mvqm-r553","tags":["advisory"]},{"url":"https://github.com/helm/helm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-1000008","description":"All versions of Helm between Helm \u003e=2.0.0 and \u003c 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.","status":"published","published":"2019-02-04T21:00:00Z","modified":"2024-08-05T03:00:19.248Z","updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2022-5856","description":"All versions of Helm between Helm \u003e=2.0.0 and \u003c 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.","status":"published","published":"2019-02-04T21:00:00Z","modified":"2024-08-05T03:00:19Z","updated_at":"2026-11-03T02:40:19.824838Z"}],"ghsa":[{"id":"GHSA-xrxm-mvqm-r553","title":"Helm Path Traversal","description":"All versions of Helm between Helm \u003e=2.0.0 and \u003c 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.","status":"published","published":"2022-05-14T01:33:54Z","modified":"2023-09-28T20:38:53Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2019-1000008","description":"All versions of Helm between Helm \u003e=2.0.0 and \u003c 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.","status":"published","published":"2019-02-04T21:29:00.91Z","modified":"2026-06-17T02:09:26.073Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"CVE-2019-1000008","description":"All versions of Helm between Helm \u003e=2.0.0 and \u003c 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.","status":"published","published":"2019-02-04T21:29:00.91Z","modified":"2026-10-24T10:30:18.334604566Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"GHSA-xrxm-mvqm-r553","title":"Helm Path Traversal","description":"All versions of Helm between Helm \u003e=2.0.0 and \u003c 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.","status":"published","published":"2022-05-14T01:33:54Z","modified":"2024-08-20T20:58:36.215106Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"GO-2023-1948","title":"Helm Path Traversal in helm.sh/helm","description":"Helm Path Traversal in helm.sh/helm","status":"published","published":"2024-08-20T20:31:38Z","modified":"2026-03-03T04:54:01.882865Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}