CVE-2020-4053
In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP.
Does this matter?
Lower severity and a low EPSS score (1.46%). Track it; it rarely justifies an emergency change on its own.
Description
In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a file outside of the intended directory. This has been fixed in 3.2.4.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.46% probability · 73th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- helm/helm
- Source
- security-advisories@github.com
EPSS 1.5% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/helm/helm/commit/0ad800ef43d3b826f31a5ad8dfbb4fe05d143688Patch
- https://github.com/helm/helm/releases/tag/v3.2.4Release Notes
- https://github.com/helm/helm/security/advisories/GHSA-qq3j-xp49-j73fVendor Advisory
- https://github.com/helm/helm/commit/0ad800ef43d3b826f31a5ad8dfbb4fe05d143688Patch
- https://github.com/helm/helm/releases/tag/v3.2.4Release Notes
- https://github.com/helm/helm/security/advisories/GHSA-qq3j-xp49-j73fVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.