CVE-2026-35206

mediumpriority · track · 18EPSS 0.002 · 10 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.20% (10th) EPSS

CVSS 4.4 · medium

Is it mine?

19 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

cvss

Technical severity, 0–10. One row per scoring source.

5.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.1–5.1

v3.14.4mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Lprimary · NVD / NIST USexploitability 1.8 · impact 2.5

v3.15.1mediumAV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · FSTEC (BDU) RU

v4.04.8mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.04.8mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.01.1lowCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-22USCWE-22US

affected products (19)

Products and version ranges known to be affected.

Microsoft Azure Linux azl3all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Open Source helm< 3.20.2cert_bundDE
Open Source helm< 4.1.4cert_bundDE
helm helm≤ < 3.20.2enisa_euvdEU
helm helm4.0.0, → 4.1.4enisa_euvdEU
Red Hat Inc. Red Hat Advanced Cluster Security≤ 4fstec_bduRU
The Linux Foundation Helm≤ 3.20.2fstec_bduRU
The Linux Foundation Helm≤ 4.1.4fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 8.0fstec_bduRU
helm helm< 3.20.2nvdUScpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*
helm helm4.0.0 → 4.1.4nvdUScpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*
Bitnami helm< 3.20.2osvUSpkg:bitnami/helm
Bitnami helm4.0.0 → 4.1.4osvUSpkg:bitnami/helm
Go helm.sh/helm/v3< 3.20.2osvUSpkg:golang/helm.sh/helm/v3
Go helm.sh/helm/v4< 4.1.4osvUSpkg:golang/helm.sh/helm/v4

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1048helm: Mehrere SchwachstellenDeutsch2026-04-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in helm ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, und potenziell um beliebigen Code auszuführen.
GHSA-hr2v-4r36-88hrHelm Chart extraction output directory collapse via `Chart.yaml` name dot-segment2026-04-10ghsa · osvUS
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause `helm pull --untar [chart URL | repo/chartname]` to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the `--destination` and `--untardir` flags), rather than the expected output directory suffixed by the chart's name. ### Impact The bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory `<output dir>/`, instead of the expected `<output dir>/<chart name>/`, potentially overwriting the contents of the targeted directory. Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. ### Patches This issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. ### Workarounds Ensure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the `pull --untar` flag (or equivalent SDK option) refers to a unique/empty output directory prevents chart extraction from inadvertently overwriting existing files within the specified directory. ### Credits Oleh Konko @1seal
BIT-helm-2026-35206Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment2026-04-13vendor · osvUS
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.
GO-2026-5435Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm2026-07-24vendor · osvUS
Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2026-04-09modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan