GitHub Advisoryadvisory · Go

GHSA-242m-6h72-7hgp ingress-nginx controller - auth secret file path traversal vulnerability

MEDIUM Published 2025-03-25 Modified 2025-11-04 Official page ↗
Aliases
CVE-2025-24513
Ecosystem
Go
Packages
k8s.io/ingress-nginx
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weaknesses
CWE-20, CWE-22
Reviewed
2025-03-25

Affected packages

• Go k8s.io/ingress-nginx: < 1.11.5 → fixed in 1.11.5 • Go k8s.io/ingress-nginx: >= 1.12.0-beta.0, < 1.12.1 → fixed in 1.12.1

Description

A security issue was discovered in ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.

Related

Alias · CVE (1)

  • CVE-2025-24513 A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References