Chartmuseum
Approved changes feed: RSS · Atom
cpe:2.3:a:helm:chartmuseum:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Helm (71267bd7-64b0-5f44-857e-15242149db79) |
|---|---|
| Product | Chartmuseum (d53f1239-0f0a-5685-a24a-eccd8bb8f8ff) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/helm/chartmuseum |
purl2cpe | 2026-06-01 10:15:06.077113 |
pkg:rpm/opensuse/chartmuseum |
purl2cpe | 2026-06-01 10:15:06.077116 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-1000009 |
vulnerable | 2026-06-08 05:12:21.341958 |
Details available
Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HTTP API to save charts that can result in a specially crafted chart could be uploaded and saved outside the intended location. This attack appears to be exploitable via A POST request to the HTTP API can save a chart archive outside of the intended directory. If authentication is, optionally, enabled this requires an authorized user to do so. This vulnerability appears to have been fixed in 0.8.1.
Published: 2019-02-04T21:00:00.000Z
Updated: 2024-08-05T03:00:19.238Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.