Specially crafted url can be created which leads to a directory traversal in the salt file server

CVE-2024-22232

Summary

A directory traversal vulnerability in the Salt File Server allows an attacker to craft a specially designed URL that exploits the server's file path handling. This vulnerability enables a malicious user to access arbitrary files on the Salt master’s filesystem, potentially leading to unauthorized disclosure of sensitive information. Admins of affected systems should implement security measures and updates to mitigate this vulnerability and protect against unauthorized file access.

References