CVE-2024-38824 CVE-2024-38824 salt advisory
An attacker can write arbitrary files to the master cache directory via a directory traversal vulnerability in the recv_file method.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38824?
CVE-2024-38824 is a critical path traversal vulnerability in Saltstack Salt, published on 13 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.
Weakness: CWE-22
Which versions are affected by CVE-2024-38824?
5 open source packages ship an affected version, including salt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | From 3006.0rc1 | 3006.12, 3007.4 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3007.0rc1 | 3007.4 |
salt PyPI | From 3007.0rc1 | 3007.4 |
Products include Saltstack Salt.
How do I fix CVE-2024-38824?
Upgrade salt to a fixed version for your release line: 3006.12 or 3007.4.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-38824 being exploited?
There is no known exploitation of CVE-2024-38824 in the wild and no public exploit code.
Other vulnerabilities in Saltstack Salt
- CVE-2013-4437 SaltStack insecurely uses /tmp
- CVE-2013-6617 SaltStack Privilege Escalation vulnerability
- CVE-2021-33226 Code injection in n/a
- CVE-2021-25315 salt-api unauthenticated remote code execution
- CVE-2018-15751 SaltStack Salt Remote command execution and incorrect access control when using salt-api
Sources
Also known as GHSA-8pcp-r83j-fc92, PYSEC-2026-529, UBUNTU-CVE-2024-38824.