Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-fwas-eecc-3bau
Summary
Salt allows arbitrary directory creation or file deletion
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.
Aliases
0
alias CVE-2025-22240
1
alias GHSA-xh32-3m67-qjgf
Fixed_packages
0
url pkg:pypi/salt@3006.12
purl pkg:pypi/salt@3006.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fxhr-smeg-k7fj
1
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.12
1
url pkg:pypi/salt@3007.4
purl pkg:pypi/salt@3007.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fxhr-smeg-k7fj
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.4
Affected_packages
0
url pkg:pypi/salt@3006.0rc1
purl pkg:pypi/salt@3006.0rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-ce2x-ehyk-nufk
2
vulnerability VCID-em78-j177-kffg
3
vulnerability VCID-fwas-eecc-3bau
4
vulnerability VCID-nehw-r7zm-j7bb
5
vulnerability VCID-r4b7-j6au-fucm
6
vulnerability VCID-rnh5-7394-dfea
7
vulnerability VCID-sc4b-v7j2-byed
8
vulnerability VCID-t99c-dqd5-ukfk
9
vulnerability VCID-yt34-n551-1uau
10
vulnerability VCID-zeat-rzj9-u3br
11
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.0rc1
1
url pkg:pypi/salt@3006.0rc2
purl pkg:pypi/salt@3006.0rc2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-ce2x-ehyk-nufk
2
vulnerability VCID-em78-j177-kffg
3
vulnerability VCID-fwas-eecc-3bau
4
vulnerability VCID-nehw-r7zm-j7bb
5
vulnerability VCID-r4b7-j6au-fucm
6
vulnerability VCID-rnh5-7394-dfea
7
vulnerability VCID-sc4b-v7j2-byed
8
vulnerability VCID-t99c-dqd5-ukfk
9
vulnerability VCID-yt34-n551-1uau
10
vulnerability VCID-zeat-rzj9-u3br
11
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.0rc2
2
url pkg:pypi/salt@3006.0rc3
purl pkg:pypi/salt@3006.0rc3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-ce2x-ehyk-nufk
2
vulnerability VCID-em78-j177-kffg
3
vulnerability VCID-fwas-eecc-3bau
4
vulnerability VCID-nehw-r7zm-j7bb
5
vulnerability VCID-r4b7-j6au-fucm
6
vulnerability VCID-rnh5-7394-dfea
7
vulnerability VCID-sc4b-v7j2-byed
8
vulnerability VCID-t99c-dqd5-ukfk
9
vulnerability VCID-yt34-n551-1uau
10
vulnerability VCID-zeat-rzj9-u3br
11
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.0rc3
3
url pkg:pypi/salt@3006.0
purl pkg:pypi/salt@3006.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-32tp-s4fd-v7h2
1
vulnerability VCID-34yz-hgbf-abee
2
vulnerability VCID-ce2x-ehyk-nufk
3
vulnerability VCID-em78-j177-kffg
4
vulnerability VCID-fwas-eecc-3bau
5
vulnerability VCID-fwpy-42pu-8ub3
6
vulnerability VCID-nehw-r7zm-j7bb
7
vulnerability VCID-qr6n-rx38-6fd2
8
vulnerability VCID-r4b7-j6au-fucm
9
vulnerability VCID-rnh5-7394-dfea
10
vulnerability VCID-sc4b-v7j2-byed
11
vulnerability VCID-t99c-dqd5-ukfk
12
vulnerability VCID-yt34-n551-1uau
13
vulnerability VCID-zeat-rzj9-u3br
14
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.0
4
url pkg:pypi/salt@3006.1
purl pkg:pypi/salt@3006.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-32tp-s4fd-v7h2
1
vulnerability VCID-34yz-hgbf-abee
2
vulnerability VCID-ce2x-ehyk-nufk
3
vulnerability VCID-em78-j177-kffg
4
vulnerability VCID-fwas-eecc-3bau
5
vulnerability VCID-fwpy-42pu-8ub3
6
vulnerability VCID-nehw-r7zm-j7bb
7
vulnerability VCID-qr6n-rx38-6fd2
8
vulnerability VCID-r4b7-j6au-fucm
9
vulnerability VCID-rnh5-7394-dfea
10
vulnerability VCID-sc4b-v7j2-byed
11
vulnerability VCID-t99c-dqd5-ukfk
12
vulnerability VCID-yt34-n551-1uau
13
vulnerability VCID-zeat-rzj9-u3br
14
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.1
5
url pkg:pypi/salt@3006.2
purl pkg:pypi/salt@3006.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-32tp-s4fd-v7h2
1
vulnerability VCID-34yz-hgbf-abee
2
vulnerability VCID-em78-j177-kffg
3
vulnerability VCID-fwas-eecc-3bau
4
vulnerability VCID-fwpy-42pu-8ub3
5
vulnerability VCID-qr6n-rx38-6fd2
6
vulnerability VCID-r4b7-j6au-fucm
7
vulnerability VCID-rnh5-7394-dfea
8
vulnerability VCID-sc4b-v7j2-byed
9
vulnerability VCID-t99c-dqd5-ukfk
10
vulnerability VCID-yt34-n551-1uau
11
vulnerability VCID-zeat-rzj9-u3br
12
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.2
6
url pkg:pypi/salt@3006.3
purl pkg:pypi/salt@3006.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-32tp-s4fd-v7h2
1
vulnerability VCID-34yz-hgbf-abee
2
vulnerability VCID-em78-j177-kffg
3
vulnerability VCID-fwas-eecc-3bau
4
vulnerability VCID-fwpy-42pu-8ub3
5
vulnerability VCID-qr6n-rx38-6fd2
6
vulnerability VCID-r4b7-j6au-fucm
7
vulnerability VCID-rnh5-7394-dfea
8
vulnerability VCID-sc4b-v7j2-byed
9
vulnerability VCID-t99c-dqd5-ukfk
10
vulnerability VCID-yt34-n551-1uau
11
vulnerability VCID-zeat-rzj9-u3br
12
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.3
7
url pkg:pypi/salt@3006.4
purl pkg:pypi/salt@3006.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-32tp-s4fd-v7h2
1
vulnerability VCID-34yz-hgbf-abee
2
vulnerability VCID-em78-j177-kffg
3
vulnerability VCID-fwas-eecc-3bau
4
vulnerability VCID-fwpy-42pu-8ub3
5
vulnerability VCID-qr6n-rx38-6fd2
6
vulnerability VCID-r4b7-j6au-fucm
7
vulnerability VCID-sc4b-v7j2-byed
8
vulnerability VCID-t99c-dqd5-ukfk
9
vulnerability VCID-yt34-n551-1uau
10
vulnerability VCID-zeat-rzj9-u3br
11
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.4
8
url pkg:pypi/salt@3006.5
purl pkg:pypi/salt@3006.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-32tp-s4fd-v7h2
1
vulnerability VCID-34yz-hgbf-abee
2
vulnerability VCID-em78-j177-kffg
3
vulnerability VCID-fwas-eecc-3bau
4
vulnerability VCID-fwpy-42pu-8ub3
5
vulnerability VCID-qr6n-rx38-6fd2
6
vulnerability VCID-r4b7-j6au-fucm
7
vulnerability VCID-sc4b-v7j2-byed
8
vulnerability VCID-t99c-dqd5-ukfk
9
vulnerability VCID-yt34-n551-1uau
10
vulnerability VCID-zeat-rzj9-u3br
11
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.5
9
url pkg:pypi/salt@3006.6
purl pkg:pypi/salt@3006.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
9
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.6
10
url pkg:pypi/salt@3006.7
purl pkg:pypi/salt@3006.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
9
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.7
11
url pkg:pypi/salt@3006.8
purl pkg:pypi/salt@3006.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
9
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.8
12
url pkg:pypi/salt@3006.9
purl pkg:pypi/salt@3006.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
9
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.9
13
url pkg:pypi/salt@3006.10
purl pkg:pypi/salt@3006.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
9
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.10
14
url pkg:pypi/salt@3006.11
purl pkg:pypi/salt@3006.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
9
vulnerability VCID-zudw-npmj-2qe8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.11
15
url pkg:pypi/salt@3007.0rc1
purl pkg:pypi/salt@3007.0rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-r4b7-j6au-fucm
4
vulnerability VCID-sc4b-v7j2-byed
5
vulnerability VCID-t99c-dqd5-ukfk
6
vulnerability VCID-yt34-n551-1uau
7
vulnerability VCID-zeat-rzj9-u3br
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.0rc1
16
url pkg:pypi/salt@3007.0
purl pkg:pypi/salt@3007.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.0
17
url pkg:pypi/salt@3007.1
purl pkg:pypi/salt@3007.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.1
18
url pkg:pypi/salt@3007.2
purl pkg:pypi/salt@3007.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.2
19
url pkg:pypi/salt@3007.3
purl pkg:pypi/salt@3007.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34yz-hgbf-abee
1
vulnerability VCID-em78-j177-kffg
2
vulnerability VCID-fwas-eecc-3bau
3
vulnerability VCID-fwpy-42pu-8ub3
4
vulnerability VCID-r4b7-j6au-fucm
5
vulnerability VCID-sc4b-v7j2-byed
6
vulnerability VCID-t99c-dqd5-ukfk
7
vulnerability VCID-yt34-n551-1uau
8
vulnerability VCID-zeat-rzj9-u3br
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.3
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-22240
reference_id
reference_type
scores
0
value 0.00095
scoring_system epss
scoring_elements 0.26346
published_at 2026-06-07T12:55:00Z
1
value 0.00095
scoring_system epss
scoring_elements 0.2639
published_at 2026-06-06T12:55:00Z
2
value 0.00095
scoring_system epss
scoring_elements 0.26398
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-22240
1
reference_url https://docs.saltproject.io/en/3006/topics/releases/3006.12.html
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-13T13:40:39Z/
url https://docs.saltproject.io/en/3006/topics/releases/3006.12.html
2
reference_url https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-13T13:40:39Z/
url https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/saltstack/salt
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/saltstack/salt
5
reference_url https://github.com/saltstack/salt/commit/f7c28ffbf18dbf693a15b1ba9493918de3e88cf3
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/saltstack/salt/commit/f7c28ffbf18dbf693a15b1ba9493918de3e88cf3
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-22240
reference_id CVE-2025-22240
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-22240
7
reference_url https://github.com/advisories/GHSA-xh32-3m67-qjgf
reference_id GHSA-xh32-3m67-qjgf
reference_type
scores
url https://github.com/advisories/GHSA-xh32-3m67-qjgf
Weaknesses
0
cwe_id 22
name Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-fwas-eecc-3bau