Directory Traversal Vulnerability in Helm Package Manager

CVE-2026-35206

What is CVE-2026-35206?

A directory traversal vulnerability exists in Helm, a popular package manager for Kubernetes. Specifically, in Helm versions 3.20.1 and 4.1.3, when executing the command 'helm pull --untar [chart URL | repo/chartname]', the Chart's contents can be written directly to the current working directory instead of the designated output directory, which is normally suffixed by the chart's name. This behavior can lead to unintended file overwrites and potential exposure of sensitive information. The issue has been addressed in versions 3.20.2 and 4.1.4, where the output directory handling has been corrected.

References