Name: CVE-2025-22238: Improper Limitation of a Pathname to a Restricted Directory
Creator: Rapid7
Published: 2025-06-13T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2025-22238, CVSS 4.2, EPSS 0.00137

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.

CVSS Details

CVSS 3.1 Base Score: 4.2
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Suse	—	Upgrade python3-saltUpgrade salt-fish-completionUpgrade salt-minionUpgrade salt-bash-completionUpgrade salt-masterUpgrade salt-proxyUpgrade salt-transactional-updateUpgrade salt-docUpgrade saltUpgrade salt-zsh-completionUpgrade salt-sshUpgrade python3-salt-testsuiteUpgrade salt-standalone-formulas-configurationUpgrade salt-apiUpgrade salt-syndicUpgrade salt-cloud	Dec 5, 2025	Jul 23, 2025

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence