Log in Start free

Vulnerability · Published Apr 9, 2026 · Assigned by GitHub_M

CVE-2026-35204Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

High 8.2

In plain English

A high-severity path traversal in helm from helm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.2%top 89.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem location. To prevent this, validate that the plugin.yaml of the Helm plugin does not include a version: field containing POSIX dot-dot path separators ie. "/../". This vulnerability is fixed in 4.1.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gohelm.sh/helm/v44.1.4GHSA-vmx8-mqv2-9gmg
Gohelm.sh/helm/v44.1.4GO-2026-5666

Affected products (as reported)

VendorProductVersions
helm helm >= 4.0.0, < 4.1.4

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References