/
DirectorySecurity AdvisoriesPricing
Sign in
Security Advisories

CVE-2022-24877

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-24877

Severity

9.9

Critical

CVSS V3

Summary

Improper path handling in kustomization files allows path traversal

Description

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate kustomization.yaml files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.

References

  • https://images.chainguard.dev/security/CGA-p8v9-qhp5-57fj

Affected packages


Safe Source for Open Source™
Contact us
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard ContainersChainguard LibrariesChainguard VMsIntegrationsPricing