CVE-2025-24513CWE-20

ingress-nginx controller - auth secret file path traversal vulnerability

Medium · published March 24, 2025

CVSS v3.1
4.8
EPSS
3%
Percentile
88.6
In the wild
Unconfirmed
What it is

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.03331 · 88.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-03-24T23:29Z
EPSS history
Timeline
  • 24 MAR 23:29Z
    ingress-nginx controller - auth secret file path traversal vulnerability
    cvelistv5