CVE-2026-35206

Medium

Advisory

Published 10 Apr 2026In the index since 5 Sept 2026

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Carried by container images the latest versions of 201 of 17,787 indexed charts deploy, on 210 images.

Affected package	Affected versions	Fixed in	Images
helm.sh/helm/v3golang	v0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+80 more	3.20.2	208
helm.sh/helm/v4golang	v4.0.0-20250324191910-0199b748aaea, v4.1.0, v4.1.3	4.1.4	5

201 by stars

Chart

Latest

Affected images

Radar Score

1 of the 5 container images this version deploys carry CVE-2026-35206.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01	3.20.2

13,197

210 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	helm.sh/helm/v3@v3.7.1	3.20.2	1
quay.io/operator-framework/catalogd :v1.8.0	6ff40fa6257f	helm.sh/helm/v3@v3.20.0	3.20.2	1
quay.io/operator-framework/operator-controller :v1.8.0	bca5dfcc67ca	helm.sh/helm/v3@v3.20.0	3.20.2	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	helm.sh/helm/v3@v3.3.4	3.20.2	1
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	helm.sh/helm/v3@v3.6.3	3.20.2	1
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	helm.sh/helm/v3@v3.6.3	3.20.2	1
registry.gitlab.com/bitspur/rock8s/images/kube-commands :3.18	80ef8ceffc92	helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e	3.20.2	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	helm.sh/helm/v3@v3.7.0	3.20.2	1
registry.gitlab.com/xrow-public/ci-tools/tools :main	9b9d1ed86b6a	helm.sh/helm/v3@v3.18.4	3.20.2	1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller :2.1.2	301847adfe16	helm.sh/helm/v3@v3.18.4	3.20.2	1