StackRadar

CVE-2024-25620

Medium

Advisory

Published 15 Feb 2024In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.4
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
129
of 17,781 indexed, latest versions
Container images
124
deployed by those charts
Fix available
1 of 2
affected packages

Helm dependency management path traversal

Carried by container images the latest versions of 129 of 17,781 indexed charts deploy, on 124 images.

Affected packageAffected versionsFixed inImages
helm.sh/helm/v3golangv0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+54 more3.14.1124
helmdeb3.18.1-1no fix listed1
OSV records
GHSA-v53g-5gjp-272rUBUNTU-CVE-2024-25620
Also known as
BIT-helm-2024-25620, GO-2024-2554

Charts affected

129 by stars
ChartLatestAffected imagesRadar Score
vcluster-pro-k0sloftVerified publisher0.0.0-ci-run.102 of 2See more

vcluster-pro-k0s loft 0.0.0-ci-run.10

2 of the 2 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
helm.sh/helm/v3@v3.10.3
3.14.1
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.1

Open the chart page →

5,768
vcluster-pro-k8sloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-k8s loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.1

Open the chart page →

8,202
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
helm.sh/helm/v3@v3.13.0
3.14.1

Open the chart page →

9,774
cert-manager-setupmesosphere-stable0.2.101 of 5See more

cert-manager-setup mesosphere-stable 0.2.10

1 of the 5 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.11.074611761f052
helm.sh/helm/v3@v3.10.3
3.14.1

Open the chart page →

7,179
istio-operatormetakube1.12.01 of 1See more

istio-operator metakube 1.12.0

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
istio/operator:1.12.06cfce8a071b9
helm.sh/helm/v3@v3.7.1
3.14.1

Open the chart page →

8,902
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
helm.sh/helm/v3@v0.0.0-20250819195950-b76a950f6835
3.14.1

Open the chart page →

3,843
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
helm.sh/helm/v3@v0.0.0-20250616185904-6838ebcf265a
3.14.1

Open the chart page →

17,070
multicluster-meshocm-helm-chartsVerified publisher0.0.21 of 1See more

multicluster-mesh ocm-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
helm.sh/helm/v3@v3.8.0
3.14.1

Open the chart page →

2,124
fsmopenshift0.1.8-ubi.61 of 6See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
helm.sh/helm/v3@v3.7.1
3.14.1

Open the chart page →

16,556
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6
3.14.1

Open the chart page →

2,525
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
helm.sh/helm/v3@v0.0.0-20240221201614-c309b6f0ff63
3.14.1

Open the chart page →

4,127
npre-essentialsphntom0.1.601 of 22See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.15.29242b4df9e65
helm.sh/helm/v3@v3.9.4
3.14.1

Open the chart page →

26,840
planectlplanectlVerified publisher0.7.02 of 10See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
alpine/k8s:1.30.2cd560fce90f7
helm.sh/helm/v3@v0.0.0-20240612132704-1a500d562541
3.14.1
quay.io/argoproj/argocd:v2.14.115fc69e31c755
helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e
3.14.1

Open the chart page →

25,934
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
helm.sh/helm/v3@v3.0.2
3.14.1

Open the chart page →

11,151
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.14.1

Open the chart page →

12,754
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac
3.14.1

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac
3.14.1

Open the chart page →

3,270
quarksquarks7.0.1+0.g5396b111 of 5See more

quarks quarks 7.0.1+0.g5396b11

1 of the 5 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/cloudfoundry-incubator/quarks-secret:v1.0.754f059af4de8ed
helm.sh/helm/v3@v3.3.0
3.14.1

Open the chart page →

18,197
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
helm.sh/helm/v3@v3.3.4
3.14.1

Open the chart page →

29,227
backup-maker-controllerriotkit-org0.1.21 of 1See more

backup-maker-controller riotkit-org 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/backup-maker-controller:v0.1.262370545ba3d
helm.sh/helm/v3@v3.10.3
3.14.1

Open the chart page →

1,575
krr-enforcerrobusta0.3.51 of 2See more

krr-enforcer robusta 0.3.5

1 of the 2 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
alpine/k8s:1.30.0bd01dae02676
helm.sh/helm/v3@v0.0.0-20240410185915-81c902a12346
3.14.1

Open the chart page →

4,038
gitlab-operatorrock8sVerified publisher0.7.01 of 2See more

gitlab-operator rock8s 0.7.0

1 of the 2 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
helm.sh/helm/v3@v3.7.0
3.14.1

Open the chart page →

5,422
mailserverrock8sVerified publisher0.1.21 of 1See more

mailserver rock8s 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
registry.gitlab.com/bitspur/rock8s/images/kube-commands:3.1880ef8ceffc92
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.14.1

Open the chart page →

1,946
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
helm.sh/helm/v3@v3.12.3
3.14.1
quay.io/devtron/kubectl:latest2ad610626658
helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4
3.14.1

Open the chart page →

68,240
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/devtron/kubectl:latest2ad610626658
helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4
3.14.1

Open the chart page →

32,902
harborsoftonic1.13.03 of 8See more

harbor softonic 1.13.0

3 of the 8 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.9.06412d679fdc3
helm.sh/helm/v3@v3.11.3
3.14.1
goharbor/harbor-jobservice:v2.9.039435daedd0c
helm.sh/helm/v3@v3.11.3
3.14.1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
helm.sh/helm/v3@v3.12.1
3.14.1

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
helm.sh/helm/v3@v3.12.1
3.14.1

Open the chart page →

2,505
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
helm.sh/helm/v3@v3.11.0
3.14.1

Open the chart page →

6,232
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.1

Open the chart page →

13,677

Container images carrying it

124 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
helm.sh/helm/v3@v3.13.0
3.14.1
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
helm.sh/helm/v3@v3.2.0
3.14.1
1
ghcr.io/riotkit-org/backup-maker-controller:v0.1.262370545ba3d
helm.sh/helm/v3@v3.10.3
3.14.1
1
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
helm.sh/helm/v3@v3.13.1
3.14.1
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
helm.sh/helm/v3@v0.0.0-20250212201646-980d8ac1939e
3.14.1
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
helm.sh/helm/v3@v0.0.0-20250708195800-d80839cf37d8
3.14.1
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
helm.sh/helm/v3@v0.0.0-20230614175909-f32a527a0601
3.14.1
1
quay.io/bentoml/yatai:0.4.614b482c1f1b8
helm.sh/helm/v3@v3.8.2
3.14.1
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
helm.sh/helm/v3@v3.11.1
3.14.1
1
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
helm.sh/helm/v3@v3.7.1
3.14.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6
3.14.1
1
quay.io/jetstack/cert-manager-ctl:v1.13.24d9fce2c050e
helm.sh/helm/v3@v3.12.3
3.14.1
1
quay.io/jetstack/cert-manager-ctl:v1.8.0595c548dee6f
helm.sh/helm/v3@v3.8.1
3.14.1
1
quay.io/jetstack/cert-manager-ctl:v1.8.281b2d775edad
helm.sh/helm/v3@v3.8.1
3.14.1
1
quay.io/jetstack/cert-manager-ctl:v1.12.08d54fe9d0c0d
helm.sh/helm/v3@v3.12.0
3.14.1
1
quay.io/kubermatic/kubermatic:v2.24.5ebba936046ab
helm.sh/helm/v3@v3.12.2
3.14.1
1
quay.io/mittwald/brudi-operator:v0.2.3edb322094359
helm.sh/helm/v3@v3.11.3
3.14.1
1
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
helm.sh/helm/v3@v3.8.0
3.14.1
1
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
helm.sh/helm/v3@v3.7.1
3.14.1
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
helm.sh/helm/v3@v3.3.4
3.14.1
1
quay.io/solo-io/discovery:0.0.0-fork5b62aaade3c9
helm.sh/helm/v3@v3.6.3
3.14.1
1
quay.io/solo-io/gloo:0.0.0-fork9a6c84560d44
helm.sh/helm/v3@v3.6.3
3.14.1
1
registry.gitlab.com/bitspur/rock8s/images/kube-commands:3.1880ef8ceffc92
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.14.1
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
helm.sh/helm/v3@v3.7.0
3.14.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.