CVE-2026-35206 Details
Description
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.
A vulnerability exists in Helm, a package manager for Kubernetes, in versions 3.20.1 and prior, as well as 4.1.3 and prior. The issue arises when a specially crafted Chart is pulled using the 'helm pull --untar' command. Instead of extracting the Chart's contents into a subdirectory named after the Chart, the files are written directly to the specified output directory or the current working directory. This behavior can lead to unintentional overwriting of existing files. The vulnerability is caused by improper handling of Chart names that include dot-segments or slashes, which can manipulate the extraction path.
Users can upgrade to Helm versions 3.20.2 or 4.1.4, where this vulnerability has been fixed. For those unable to upgrade, ensure that Chart names do not include dot-segments or slashes, and use a unique, empty output directory to prevent overwriting existing files.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436 | [email protected] | Patch |
| https://github.com/helm/helm/releases/tag/v4.1.4 | [email protected] | ProductRelease Notes |
| https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| helm helm | < 3.20.2 >= 4.0.0, < 4.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | New CVE Received | [email protected] |