CVE-2019-1000008 Helm Path Traversal

What is CVE-2019-1000008?

CVE-2019-1000008 is a medium-severity path traversal vulnerability in n/a, published on 4 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.

Weakness: CWE-22

Which versions are affected by CVE-2019-1000008?

3 open source packages ship an affected version, including helm.sh/helm. It affects 1 product.

Products include Helm Helm.

How do I fix CVE-2019-1000008?

Upgrade helm.sh/helm to a fixed version for your release line: 2.12.2 or 2.12.2+incompatible.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-1000008 being exploited?

There is no known exploitation of CVE-2019-1000008 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-18658 Helm Unsafe Link Following Critical 9.8
• CVE-2019-1010275 Helm Improper Certificate Validation Critical 9.8
• CVE-2019-25210 Information disclosure in n/a Critical 9.1
• CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution High 8.5
• CVE-2020-11013 lookup Function Information Discolosure in Helm High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xrxm-mvqm-r553, GO-2023-1948.