Open-source package vulnerability · PyPI
CVE-2024-38824: Salt vulnerable to directory traversal attack in file receiving method
criticalCVSS 3.1 9.6GHSA-8pcp-r83j-fc92
Directory traversal vulnerability in recvfile method allows arbitrary files to be written to the master cache directory.
Published Jun 13, 2025
Affected packages
salt
- Ecosystem
- PyPI
- Affected
- >= 3007.0rc1, < 3007.4
- Fixed in
- 3007.4
- Check
pip show salt
salt
- Ecosystem
- PyPI
- Affected
- >= 3006.0rc1, < 3006.12
- Fixed in
- 3006.12
- Check
pip show salt
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-38824
- https://docs.saltproject.io/en/3006/topics/releases/3006.12.html
- https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
- https://github.com/saltstack/salt/commit/c4ad23f0f3132d8d8a88f19fa537dc42cf21b215
- https://github.com/advisories/GHSA-8pcp-r83j-fc92
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology