CVE-2025-22241 CVE-2025-22241 salt advisory
Attackers can overwrite files in the PKI directory via path traversal in on-demand pillar requests, potentially escalating privileges in Salt deployments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-22241?
CVE-2025-22241 is a medium-severity path traversal vulnerability in VMware SALT, published on 13 Jun 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.
Weakness: CWE-22
Which versions are affected by CVE-2025-22241?
5 open source packages ship an affected version, including salt.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3007.0rc1 | 3007.4, 3006.12 |
salt PyPI | From 3007.0rc1 | 3007.4 |
salt PyPI | From 3007.0rc1 | 3007.4 |
How do I fix CVE-2025-22241?
Upgrade salt to a fixed version for your release line: 3006.12 or 3007.4.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-22241 being exploited?
There is no known exploitation of CVE-2025-22241 in the wild and no public exploit code.
Sources
Also known as GHSA-7f3f-x5f5-79gw, PYSEC-2026-1895, UBUNTU-CVE-2025-22241.