CVE-2021-39143 Path Traversal in spinnaker
Attackers can exploit path traversal in TAR file extraction during AppEngine deployments to overwrite system files, potentially enabling man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39143?
CVE-2021-39143 is a medium-severity path traversal vulnerability in spinnaker, published on 4 Jan 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system files. This would allow an attacker to override files on the container, POTENTIALLY introducing a MITM type attack vector by replacing libraries or injecting wrapper files. Users are advised to update as soon as possible. For users unable to update disable Google AppEngine deployments and/or disable artifacts that provide TARs.
Weakness: CWE-22
Which versions are affected by CVE-2021-39143?
It affects 1 product.
Products include Linuxfoundation Spinnaker.
How do I fix CVE-2021-39143?
No fix has been published for CVE-2021-39143 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-39143 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-39143 exists.
Other vulnerabilities in spinnaker
- CVE-2026-32604 Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
- CVE-2026-32613 Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
- CVE-2021-43832 Improper Access Control in spinnaker
- CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types
- CVE-2020-9301 Code injection in Netflix Spinnaker