Vulnerability · Published Mar 24, 2025 · Assigned by kubernetes
CVE-2025-24513ingress-nginx controller - auth secret file path traversal vulnerability
Medium 4.8
In plain English
A medium-severity improper input validation in ingress-nginx from kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | k8s.io/ingress-nginx | 1.11.5 | GHSA-242m-6h72-7hgp |
| Go | k8s.io/ingress-nginx | 1.12.1 | GHSA-242m-6h72-7hgp |
| Go | k8s.io/ingress-nginx | no fix listed | GO-2025-3564 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kubernetes | ingress-nginx | 0 – through 1.11.41.12.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L