StackRadar

CVE-2024-25620

Medium

Advisory

Published 15 Feb 2024In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.4
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
129
of 17,781 indexed, latest versions
Container images
124
deployed by those charts
Fix available
1 of 2
affected packages

Helm dependency management path traversal

Carried by container images the latest versions of 129 of 17,781 indexed charts deploy, on 124 images.

Affected packageAffected versionsFixed inImages
helm.sh/helm/v3golangv0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+54 more3.14.1124
helmdeb3.18.1-1no fix listed1
OSV records
GHSA-v53g-5gjp-272rUBUNTU-CVE-2024-25620
Also known as
BIT-helm-2024-25620, GO-2024-2554

Charts affected

129 by stars
ChartLatestAffected imagesRadar Score
vcluster-pro-k0sloftVerified publisher0.0.0-ci-run.102 of 2See more

vcluster-pro-k0s loft 0.0.0-ci-run.10

2 of the 2 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
helm.sh/helm/v3@v3.10.3
3.14.1
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.1

Open the chart page →

5,768
vcluster-pro-k8sloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-k8s loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.1

Open the chart page →

8,202
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
helm.sh/helm/v3@v3.13.0
3.14.1

Open the chart page →

9,774
cert-manager-setupmesosphere-stable0.2.101 of 5See more

cert-manager-setup mesosphere-stable 0.2.10

1 of the 5 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.11.074611761f052
helm.sh/helm/v3@v3.10.3
3.14.1

Open the chart page →

7,179
istio-operatormetakube1.12.01 of 1See more

istio-operator metakube 1.12.0

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
istio/operator:1.12.06cfce8a071b9
helm.sh/helm/v3@v3.7.1
3.14.1

Open the chart page →

8,902
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
helm.sh/helm/v3@v0.0.0-20250819195950-b76a950f6835
3.14.1

Open the chart page →

3,843
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
helm.sh/helm/v3@v0.0.0-20250616185904-6838ebcf265a
3.14.1

Open the chart page →

17,070
multicluster-meshocm-helm-chartsVerified publisher0.0.21 of 1See more

multicluster-mesh ocm-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
helm.sh/helm/v3@v3.8.0
3.14.1

Open the chart page →

2,124
fsmopenshift0.1.8-ubi.61 of 6See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
helm.sh/helm/v3@v3.7.1
3.14.1

Open the chart page →

16,556
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6
3.14.1

Open the chart page →

2,525
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
helm.sh/helm/v3@v0.0.0-20240221201614-c309b6f0ff63
3.14.1

Open the chart page →

4,127
npre-essentialsphntom0.1.601 of 22See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.15.29242b4df9e65
helm.sh/helm/v3@v3.9.4
3.14.1

Open the chart page →

26,840
planectlplanectlVerified publisher0.7.02 of 10See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
alpine/k8s:1.30.2cd560fce90f7
helm.sh/helm/v3@v0.0.0-20240612132704-1a500d562541
3.14.1
quay.io/argoproj/argocd:v2.14.115fc69e31c755
helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e
3.14.1

Open the chart page →

25,934
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
helm.sh/helm/v3@v3.0.2
3.14.1

Open the chart page →

11,151
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.14.1

Open the chart page →

12,754
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac
3.14.1

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac
3.14.1

Open the chart page →

3,270
quarksquarks7.0.1+0.g5396b111 of 5See more

quarks quarks 7.0.1+0.g5396b11

1 of the 5 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/cloudfoundry-incubator/quarks-secret:v1.0.754f059af4de8ed
helm.sh/helm/v3@v3.3.0
3.14.1

Open the chart page →

18,197
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
helm.sh/helm/v3@v3.3.4
3.14.1

Open the chart page →

29,227
backup-maker-controllerriotkit-org0.1.21 of 1See more

backup-maker-controller riotkit-org 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/backup-maker-controller:v0.1.262370545ba3d
helm.sh/helm/v3@v3.10.3
3.14.1

Open the chart page →

1,575
krr-enforcerrobusta0.3.51 of 2See more

krr-enforcer robusta 0.3.5

1 of the 2 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
alpine/k8s:1.30.0bd01dae02676
helm.sh/helm/v3@v0.0.0-20240410185915-81c902a12346
3.14.1

Open the chart page →

4,038
gitlab-operatorrock8sVerified publisher0.7.01 of 2See more

gitlab-operator rock8s 0.7.0

1 of the 2 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
helm.sh/helm/v3@v3.7.0
3.14.1

Open the chart page →

5,422
mailserverrock8sVerified publisher0.1.21 of 1See more

mailserver rock8s 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
registry.gitlab.com/bitspur/rock8s/images/kube-commands:3.1880ef8ceffc92
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.14.1

Open the chart page →

1,946
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
helm.sh/helm/v3@v3.12.3
3.14.1
quay.io/devtron/kubectl:latest2ad610626658
helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4
3.14.1

Open the chart page →

68,240
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
quay.io/devtron/kubectl:latest2ad610626658
helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4
3.14.1

Open the chart page →

32,902
harborsoftonic1.13.03 of 8See more

harbor softonic 1.13.0

3 of the 8 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.9.06412d679fdc3
helm.sh/helm/v3@v3.11.3
3.14.1
goharbor/harbor-jobservice:v2.9.039435daedd0c
helm.sh/helm/v3@v3.11.3
3.14.1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
helm.sh/helm/v3@v3.12.1
3.14.1

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
helm.sh/helm/v3@v3.12.1
3.14.1

Open the chart page →

2,505
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
helm.sh/helm/v3@v3.11.0
3.14.1

Open the chart page →

6,232
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2024-25620.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.1

Open the chart page →

13,677

Container images carrying it

124 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/kubectl:latest2ad610626658
helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4
3.14.1
6
keelhq/keel:latest73714afb4443
helm.sh/helm/v3@v3.13.1
3.14.1
5
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.1
4
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
helm.sh/helm/v3@v3.12.3
3.14.1
4
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
helm.sh/helm/v3@v3.12.3
3.14.1
3
dtzar/helm-kubectl:3.14.455429449408e
helm.sh/helm/v3@v0.0.0-20240410185915-81c902a12346
3.14.1
2
ilum/api:6.7.3624fd09528c8
helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6
3.14.1
2
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
helm.sh/helm/v3@v3.10.3
3.14.1
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
helm@3.18.1-1
helm.sh/helm/v3@v0.0.0-20250527180604-f6f8700a539c
no fix listed
3.14.1
2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e
3.14.1
2
quay.io/jetstack/cert-manager-ctl:v1.11.074611761f052
helm.sh/helm/v3@v3.10.3
3.14.1
2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac
3.14.1
2
alpine/helm105741fa6621
helm.sh/helm/v3@v0.0.0-20240814142712-fa9efb07d9d8
3.14.1
1
alpine/k8s:1.22.600ac10bcb759
helm.sh/helm/v3@v3.7.1
3.14.1
1
alpine/k8s:1.27.321b24e6bf801
helm.sh/helm/v3@v3.11.3
3.14.1
1
alpine/k8s:1.31.106dbe6f391eda
helm.sh/helm/v3@v0.0.0-20250616185904-6838ebcf265a
3.14.1
1
alpine/k8s:1.31.137a319b15cfc9
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.14.1
1
alpine/k8s:1.32.47e1e7d5b7a96
helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6
3.14.1
1
alpine/k8s:1.31.49c4976d47656
helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e
3.14.1
1
alpine/k8s:1.18.16a41efe02a041
helm.sh/helm/v3@v3.5.1
3.14.1
1
alpine/k8s:1.30.0bd01dae02676
helm.sh/helm/v3@v0.0.0-20240410185915-81c902a12346
3.14.1
1
alpine/k8s:1.30.2cd560fce90f7
helm.sh/helm/v3@v0.0.0-20240612132704-1a500d562541
3.14.1
1
alpine/k8s:1.28.13e5c0b053fed7
helm.sh/helm/v3@v3.11.2
3.14.1
1
alpine/k8s:1.32.3eec354133193
helm.sh/helm/v3@v3.11.2
3.14.1
1
alpine/k8s:1.28.2fc059f056ad0
helm.sh/helm/v3@v0.0.0-20230918200057-825e86f6a7a3
3.14.1
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
helm.sh/helm/v3@v0.0.0-20240221201614-c309b6f0ff63
3.14.1
1
aquasec/trivy:0.43.1944a04445179
helm.sh/helm/v3@v3.12.1
3.14.1
1
aquasec/trivy:0.32.0973d0df16189
helm.sh/helm/v3@v3.9.3
3.14.1
1
beopenit/door-helm:v3.0.1b4d9f9bee224
helm.sh/helm/v3@v3.11.3
3.14.1
1
bsgrigorov/helm-operator:latest45ab095f09c8
helm.sh/helm/v3@v3.4.1
3.14.1
1
datawire/ambassador-operator:v1.3.0f95ae710d75c
helm.sh/helm/v3@v3.0.3
3.14.1
1
devopstales/trivy-operator:2.575136aa7a26e
helm.sh/helm/v3@v3.10.3
3.14.1
1
devspacecloud/manager:0.3.349c397413f7b
helm.sh/helm/v3@v3.1.0
3.14.1
1
dtzar/helm-kubectl:3.11.2a1041bb0f1d1
helm.sh/helm/v3@v0.0.0-20230308205603-912ebc1cd10d
3.14.1
1
flanksource/batch-runner:v1.0.44689687a7cf95
helm.sh/helm/v3@v0.0.0-20250819195950-b76a950f6835
3.14.1
1
flomesh/fsm-manager:0.2.1122f849c70b25
helm.sh/helm/v3@v3.11.1
3.14.1
1
fluxcd/helm-controller:v0.9.092b891e495d8
helm.sh/helm/v3@v3.5.3
3.14.1
1
fluxcd/source-controller:v0.10.031a8c79a6803
helm.sh/helm/v3@v3.5.3
3.14.1
1
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
helm.sh/helm/v3@v3.8.0
3.14.1
1
goharbor/harbor-core:v2.9.06412d679fdc3
helm.sh/helm/v3@v3.11.3
3.14.1
1
goharbor/harbor-core:v2.5.386bf3031f4a7
helm.sh/helm/v3@v3.7.1
3.14.1
1
goharbor/harbor-jobservice:v2.9.039435daedd0c
helm.sh/helm/v3@v3.11.3
3.14.1
1
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
helm.sh/helm/v3@v3.7.1
3.14.1
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
helm.sh/helm/v3@v3.9.0
3.14.1
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
helm.sh/helm/v3@v3.12.1
3.14.1
1
hashicorp/waypoint:0.11.397d521a27498
helm.sh/helm/v3@v3.9.4
3.14.1
1
inseefrlab/shelly:cloudshell31f04ca7436b
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.14.1
1
istio/operator:1.10.3655eefa11c84
helm.sh/helm/v3@v3.5.3
3.14.1
1
istio/operator:1.12.06cfce8a071b9
helm.sh/helm/v3@v3.7.1
3.14.1
1
istio/operator:1.18.270f9d1fe5fff
helm.sh/helm/v3@v3.11.2
3.14.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.