CVE-2025-41240 Mounted Kubernetes Secrets under a predictable path located within the web server document root
Remote attackers can retrieve sensitive Kubernetes secrets via HTTP requests due to predictable file paths in web server document roots.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-41240?
CVE-2025-41240 is a critical vulnerability in VMware bitnamicharts/appsmith, published on 24 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets by accessing specific URLs if the application is exposed externally. The issue affects deployments using the default value of usePasswordFiles=true, which mounts secrets as files into the container filesystem.
Weakness: CWE-552
Which versions are affected by CVE-2025-41240?
3 open source packages ship an affected version, including appsmith, drupal and wordpress.
| Package | Affected | Fixed in |
|---|---|---|
appsmith Bitnami | From 1.62.0-0 | 1.81.0-1 |
drupal Bitnami | From 11.1.5-0 | 11.2.2-1 |
wordpress Bitnami | From 6.7.2-7 | 6.8.2-1 |
How do I fix CVE-2025-41240?
Upgrade appsmith to 1.81.0-1 or later.
Is CVE-2025-41240 being exploited?
There is no known exploitation of CVE-2025-41240 in the wild and no public exploit code.
Sources
Also known as BIT-appsmith-2025-41240, BIT-drupal-2025-41240, BIT-wordpress-2025-41240, GHSA-wgg9-9qgw-529w.