https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:14:14.473793+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07256 bdu:2026-07256 2026-10-03T03:14:14.728758+00:00 bdu:2026-07256 https://cve.radiocsirt.org/vuln/bit-helm-2026-35206 BIT-helm-2026-35206 — Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment 2026-10-03T03:14:14.728819+00:00

Affected: Bitnami: helm

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-au93241 Withdrawn: CLEANSTART-2026-AU93241 — Security fixes in helm-operator 1.42.1-r0 2026-10-03T03:14:14.728855+00:00

Withdrawn by the publisher.

Affected: CleanStart: helm-operator

Package helm-operator version 1.42.1-r0 fixes 30 vulnerabilities: ghsa-mh2q-q3fh-2475, CVE-2026-39820, ghsa-p77j-4mvh-x3m3, CVE-2026-27143, CVE-2026-42499...

 https://cve.radiocsirt.org/vuln/euvd-2026-291205 EUVD-2026-291205 2026-10-03T03:14:14.728877+00:00 EUVD-2026-291205 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35206 fkie_cve-2026-35206 2026-10-03T03:14:14.728890+00:00

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

 https://cve.radiocsirt.org/vuln/ghsa-hr2v-4r36-88hr GHSA-hr2v-4r36-88hr — Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment 2026-10-03T03:14:14.728913+00:00

Affected: Go: helm.sh/helm/v4, Go: helm.sh/helm/v3

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause `helm pull --untar [chart URL | repo/chartname]` to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the `--destination` and `--untardir` flags), rather than the expected output directory suffixed by the chart's name.

### Impact

The bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory `<output dir>/`, instead of the expected `<output dir>/<chart name>/`, potentially overwriting the contents of the targeted directory.

Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed.

### Patches

This issue has been resolved in Helm v3.20.2 and v4.1.3

A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected.

### Workarounds

Ensure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the `pull --untar` flag (or equivalent SDK option) refers to a unique/empty output directory prevents chart extraction from inadvertently overwriting existing files within the specified directory.

### Credits

Oleh Konko @1seal

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-35206 msrc_CVE-2026-35206 — Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment 2026-10-03T03:14:14.728953+00:00 msrc_CVE-2026-35206 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10532-1 openSUSE-SU-2026:10532-1 — helm3-3.20.2-1.1 on GA media 2026-10-03T03:14:14.728969+00:00

helm3-3.20.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:26441 RHSA-2026:26441 — Red Hat Security Advisory: Helm CLI v4.1.4 release 2026-10-03T03:14:14.728985+00:00

github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart

 https://cve.radiocsirt.org/vuln/suse-su-2026:21434-1 SUSE-SU-2026:21434-1 — Security update for helm 2026-10-03T03:14:14.729004+00:00

Security update for helm

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1048 WID-SEC-W-2026-1048 — helm: Mehrere Schwachstellen 2026-10-03T03:14:14.729020+00:00

Ein Angreifer kann mehrere Schwachstellen in helm ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, und potenziell um beliebigen Code auszuführen.