5.6
Medium
CVE-2025-22241 File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated…
Description
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.
Affected products and versions
Other CVEs of SALT
The 11 CVEs of SALT →
CVE-2024-38824
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory
9.6
Critical
CVE-2025-22242
Worker process denial of service through file read operation
5.6
Medium
CVE-2025-22240
Arbitrary directory creation or file deletion
6.3
Medium
CVE-2025-22239
Arbitrary event injection on Salt Master
8.1
High