CVE-2025-22240 CVE-2025-22240 salt advisory
Attackers can delete arbitrary files or create directories on the Salt Master via path traversal in GitFS, potentially causing data loss or service disruption.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-22240?
CVE-2025-22240 is a medium-severity path traversal vulnerability in VMware SALT, published on 13 Jun 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.
Weakness: CWE-22
Which versions are affected by CVE-2025-22240?
5 open source packages ship an affected version, including salt.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | From 3006.0rc1 | 3006.12, 3007.4 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3007.0rc1 | 3007.4 |
salt PyPI | From 3007.0rc1 | 3007.4 |
How do I fix CVE-2025-22240?
Upgrade salt to a fixed version for your release line: 3006.12 or 3007.4.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-22240 being exploited?
There is no known exploitation of CVE-2025-22240 in the wild and no public exploit code.
Sources
Also known as GHSA-xh32-3m67-qjgf, PYSEC-2026-1903, UBUNTU-CVE-2025-22240.