CVE-2024-7631: OpenShift Console Has a Path Traversal Vulnerability

March 19, 2025 (updated March 25, 2026)

A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint’s lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console’s pod by using sequences of ../ and valid directory paths.

References

access.redhat.com/security/cve/CVE-2024-7631
bugzilla.redhat.com/show_bug.cgi?id=2296053
github.com/advisories/GHSA-69x5-hjg4-m267
github.com/openshift/console
nvd.nist.gov/vuln/detail/CVE-2024-7631
pkg.go.dev/vuln/GO-2025-3539

Code Behaviors & Features

Detect and mitigate CVE-2024-7631 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →