CVE-2019-1000008: Path Traversal
All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands helm fetch --untar and helm lint some.tgz that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-1000008?
CVE-2019-1000008 is a vulnerability in Helm, a package manager for Kubernetes, that allows for path traversal, potentially leading to unauthorized access to files and directories.
How severe is CVE-2019-1000008?
CVE-2019-1000008 has a severity rating of 6.5, which is considered medium.
What is the affected software for CVE-2019-1000008?
The affected software for CVE-2019-1000008 is Helm version 2.0.0 up to version 2.12.2.
How can I fix CVE-2019-1000008?
To fix CVE-2019-1000008, update Helm to version 2.12.2 or higher.
Where can I find more information about CVE-2019-1000008?
You can find more information about CVE-2019-1000008 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-1000008), [Helm Security Notice](https://helm.sh/blog/helm-security-notice-2019/index.html), and [GitHub Advisory](https://github.com/advisories/GHSA-xrxm-mvqm-r553).