CVE-2025-22238 CVE-2025-22238 salt advisory
An attacker can exploit directory traversal in the Salt master's file cache to write or overwrite files outside the intended cache directory.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-22238?
CVE-2025-22238 is a medium-severity path traversal vulnerability in VMware SALT, published on 13 Jun 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.
Weakness: CWE-22
Which versions are affected by CVE-2025-22238?
5 open source packages ship an affected version, including salt.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | From 3006.0rc1 | 3006.12, 3007.4 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3007.0rc1 | 3007.4 |
salt PyPI | From 3007.0rc1 | 3007.4 |
How do I fix CVE-2025-22238?
Upgrade salt to a fixed version for your release line: 3006.12 or 3007.4.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-22238 being exploited?
There is no known exploitation of CVE-2025-22238 in the wild and no public exploit code.
Sources
Also known as GHSA-r546-h3ff-q585, PYSEC-2026-1901, UBUNTU-CVE-2025-22238.