Salt vulnerable to directory traversal attack in file receiving method

HIGH 7.5CVE-2024-38824 · GHSA-8pcp-r83j-fc92 · PYSEC-2026-529 · Published 13/06/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
salt PyPI	`≥ 3006.0rc1, < 3006.12≥ 3007.0rc1, < 3007.4`	`3006.123007.4`
salt saltstack	`≥ 3006.0, < 3006.12≥ 3007.0, < 3007.4`	`3006.123007.4`

Description

Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.

NVD description

Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.