PT-2026-31623 · Unknown+2 · Kubernetes+2
Published
2026-04-09
·
Updated
2026-05-18
·
CVE-2026-35204
CVSS v3.1
8.6
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Helm versions 4.0.0 through 4.1.3
Description
Helm, a package manager for Kubernetes Charts, contains a flaw where a crafted plugin, during installation or update, can write files to arbitrary locations on the filesystem. This occurs because the
version field within the plugin.yaml file lacks validation, allowing for the use of POSIX dot-dot path separators (e.g., "/../"). This could allow a malicious plugin author to write files outside the intended plugin directory. The issue is addressed in version 4.1.4, which adds semantic versioning validation to the version field.Recommendations
Upgrade to Helm version 4.1.4.
Examine the plugin.yaml files in your Helm plugin directory (
helm env HELM PLUGINS) and verify that the version fields do not contain unusual characters like slashes or non-semantic versioning dots.
Only install plugins from trusted sources.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Helm
Kubernetes
Red Os