CVE-2025-22240 — CVE-2025-22240 salt advisory
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variab…
Published: 2025-06-13 · CVSS: 6.3 · CVSS 3.1
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7