CVE-2024-38824: Salt vulnerable to directory traversal attack in file receiving method

June 13, 2025

Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.

References

docs.saltproject.io/en/3006/topics/releases/3006.12.html
docs.saltproject.io/en/3007/topics/releases/3007.4.html
github.com/advisories/GHSA-8pcp-r83j-fc92
github.com/saltstack/salt
github.com/saltstack/salt/commit/c4ad23f0f3132d8d8a88f19fa537dc42cf21b215
nvd.nist.gov/vuln/detail/CVE-2024-38824

Code Behaviors & Features

Detect and mitigate CVE-2024-38824 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →