Path Traversal Vulnerability in SaltStack Configuration Management
CVE-2025-22241

5.6MEDIUM

Key Information:

Vendor

Vmware
Status
Salt
Vendor
CVE Published:
13 June 2025

What is CVE-2025-22241?

A path traversal vulnerability in SaltStack Configuration Management allows attackers to exploit unvalidated input in the VirtKey class. This issue arises during the processing of 'on-demand pillar' data requests, which can lead to the creation of arbitrary file paths pointing to the 'pki directory'. The inherent functionality enables automatic acceptance of Minion authentication keys through a pre-existing 'authorization file' located in the default configuration. As such, unauthorized users could potentially overwrite critical system files, jeopardizing the integrity of the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SALT 3006.x < 3006.12

SALT 3007.x < 3007.4

References

https://docs.saltproject.io/en/3006/topics/releases/3006....
https://docs.saltproject.io/en/3007/topics/releases/3007....

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.