Arbitrary Directory Creation and File Deletion in SaltStack's GitFS
CVE-2025-22240

6.3MEDIUM

Key Information:

Vendor

Vmware
Status
Salt
Vendor
CVE Published:
13 June 2025

What is CVE-2025-22240?

A vulnerability exists within the GitFS class in SaltStack, specifically in the find_file method, where paths are constructed using unvalidated input from the 'tgt_env' variable. An attacker can exploit this weakness to perform arbitrary directory creation or delete any file, provided they have sufficient permissions within the Master's process. This could lead to severe disruptions and data loss, making it critical to address this issue promptly.

Affected Version(s)

SALT 3006.x < 3006.12

SALT 3007.x < 3007.4

References

https://docs.saltproject.io/en/3006/topics/releases/3006....
https://docs.saltproject.io/en/3007/topics/releases/3007....

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-22240 : Arbitrary Directory Creation and File Deletion in SaltStack's GitFS