CVE-2025-22241: Salt's file contents overwrite the VirtKey class

June 13, 2025 (updated June 17, 2025)

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.

References

docs.saltproject.io/en/3006/topics/releases/3006.12.html
docs.saltproject.io/en/3007/topics/releases/3007.4.html
github.com/advisories/GHSA-7f3f-x5f5-79gw
github.com/saltstack/salt
github.com/saltstack/salt/commit/9445f496fed61b15dc4364818007e5b765b0746f
nvd.nist.gov/vuln/detail/CVE-2025-22241

Code Behaviors & Features

Detect and mitigate CVE-2025-22241 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →