CVE-2025-22240 Details
Description
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.
A vulnerability in the GitFS class's find_file method allows for arbitrary file deletion on the Salt Master. The issue arises because the method constructs a file path using unvalidated input from the 'tgt_env' variable. This flaw can be exploited to delete any file that the Master's process has permission to access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 13, 2025CISA-ADP
Assessed Jun 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.saltproject.io/en/3006/topics/releases/3006.12.html | [email protected] | AdvisoryBundleRelease NotesVendor |
| https://docs.saltproject.io/en/3007/topics/releases/3007.4.html | [email protected] | AdvisoryBundleRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Salt | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 13, 2025 | CVE Modified | CISA-ADP |
| Jun 13, 2025 | New CVE Received | [email protected] |