CVE-2015-5305
MediumAdvisory
Published 15 Feb 2022In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.018
- 77th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 57
- of 17,781 indexed, latest versions
- Container images
- 45
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Directory Traversal in Kubernetes
Carried by container images the latest versions of 57 of 17,781 indexed charts deploy, on 45 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| k8s.io/ | v0.0.0-20240417172702-7c48c2bd72b9, v0.0.0-20240514104202-6911225c3f74, v0.0.0-20240611201126-f25b321b9ae4, v0.0.0-20240611201706-062798d53d83+25 more | 1.1.1 | 45 |
- OSV records
- GHSA-jp32-vmm6-3vf5
- Also known as
- GO-2022-0701
Charts affected
57 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| secret-managersecret-managerVerified publisher | 1.0.0 | 1 of 4See more | 5,497 |
| kyvernosoftonic | 3.5.2 | 1 of 7See more | 1,019 |
| spire-identity-exchangespiffeVerified publisher | 0.2.2 | 1 of 3See more | 1,427 |
| tfy-inferentia-operatortruefoundryVerified publisher | 0.2.8 | 1 of 3See more | 2,902 |
| jupyterhubuninettsigma2 | 1.6.0 | 1 of 5See more | 8,607 |
| azure-scheduledevents-managerwebdevopsVerified publisher | 1.0.17 | 1 of 1See more | 1,122 |
| xkopsxkops | 0.1.0 | 1 of 5See more | 13,677 |
Container images carrying it
45 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| clastix/ | 22918a06c253 | k8s.io/ | 1.1.1 | 6 |
| quay.io/ | 6545dac92173 | k8s.io/ | 1.1.1 | 3 |
| registry.k8s.io/ | 99b37df34bc4 | k8s.io/ | 1.1.1 | 3 |
| ghcr.io/ | 82d0b161161d | k8s.io/ | 1.1.1 | 2 |
| ghcr.io/ | c137478627cc | k8s.io/ | 1.1.1 | 2 |
| quay.io/ | 382fca2054c9 | k8s.io/ | 1.1.1 | 2 |
| registry.k8s.io/ | 74a5cf9cfa9f | k8s.io/ | 1.1.1 | 2 |
| airbyte/ | 98d2c39d512e | k8s.io/ | 1.1.1 | 1 |
| alpine/ | 6dbe6f391eda | k8s.io/ | 1.1.1 | 1 |
| alpine/ | 7a319b15cfc9 | k8s.io/ | 1.1.1 | 1 |
| alpine/ | 7e1e7d5b7a96 | k8s.io/ | 1.1.1 | 1 |
| alpine/ | 9c4976d47656 | k8s.io/ | 1.1.1 | 1 |
| alpine/ | bd01dae02676 | k8s.io/ | 1.1.1 | 1 |
| alpine/ | cd560fce90f7 | k8s.io/ | 1.1.1 | 1 |
| alpine/ | e5c0b053fed7 | k8s.io/ | 1.1.1 | 1 |
| alpine/ | eec354133193 | k8s.io/ | 1.1.1 | 1 |
| bitnamilegacy/ | 1249fc292e84 | k8s.io/ | 1.1.1 | 1 |
| bitnamilegacy/ | 64614ef8290f | k8s.io/ | 1.1.1 | 1 |
| bitnamilegacy/ | 744f84cf7493 | k8s.io/ | 1.1.1 | 1 |
| burganbank/ | 9259c34e4037 | k8s.io/ | 1.1.1 | 1 |
| dserio83/ | 6b3d9115fee2 | k8s.io/ | 1.1.1 | 1 |
| huzafach/ | 6e271d43ea48 | k8s.io/ | 1.1.1 | 1 |
| kubesphere/ | 49b445b1b732 | k8s.io/ | 1.1.1 | 1 |
| leonardomulticloud/ | d119918900e8 | k8s.io/ | 1.1.1 | 1 |
| murtazashah46/ | 4d11726cf803 | k8s.io/ | 1.1.1 | 1 |
| openpolicyagent/ | 77bc9bf3d163 | k8s.io/ | 1.1.1 | 1 |
| veecode/ | c69fd286b489 | k8s.io/ | 1.1.1 | 1 |
| webdevops/ | 7acd46a8a972 | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | a058034ca006 | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | 29ecf8d4fa65 | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | 16fda01ae58a | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | 274a179fd402 | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | c7adcc4db378 | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | a7fce69e171c | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | b5ade0d9cc6b | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | b5d7681d1b9d | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | 4d337e14c80b | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | 9f157fe035f1 | k8s.io/ | 1.1.1 | 1 |
| ghcr.io/ | 9d01bf9c9224 | k8s.io/ | 1.1.1 | 1 |
| public.ecr.aws/ | e7e1db003e6a | k8s.io/ | 1.1.1 | 1 |
| quay.io/ | 35f9c3ad644a | k8s.io/ | 1.1.1 | 1 |
| registry.k8s.io/ | 3c5268158974 | k8s.io/ | 1.1.1 | 1 |
| registry.k8s.io/ | 8ccae74fc039 | k8s.io/ | 1.1.1 | 1 |
| registry.k8s.io/ | e0b2d217d1d2 | k8s.io/ | 1.1.1 | 1 |
| registry.k8s.io/ | 46cf7475c8da | k8s.io/ | 1.1.1 | 1 |