{"schema_version":"1.7.5","id":"GHSA-hr2v-4r36-88hr","published":"2026-04-10T15:33:09Z","modified":"2026-07-24T19:11:42.050769392Z","aliases":["BIT-helm-2026-35206","CVE-2026-35206","GO-2026-5435"],"related":["CGA-2fmw-fc3p-8vp3"],"summary":"Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment","details":"Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause `helm pull --untar  [chart URL | repo/chartname]` to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the `--destination` and `--untardir` flags), rather than the expected output directory suffixed by the chart's name.\n\n### Impact\n\nThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory `<output dir>/`, instead of the expected `<output dir>/<chart name>/`, potentially overwriting the contents of the targeted directory.\n\nNote: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed.\n\n### Patches\n\nThis issue has been resolved in Helm v3.20.2 and v4.1.3\n\nA Chart with an unexpected name (those specified to be \".\" or \"..\"), or a Chart name which results in a non-unique directory will be rejected.\n\n### Workarounds\n\nEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot (\"..\") or dot (\".\"). In addition, ensuring that the `pull --untar` flag (or equivalent SDK option) refers to a unique/empty output directory prevents chart extraction from inadvertently overwriting existing files within the specified directory.\n\n### Credits\n\nOleh Konko\n@1seal","affected":[{"package":{"name":"helm.sh/helm/v4","ecosystem":"Go","purl":"pkg:golang/helm.sh/helm/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.4"}]}],"database_specific":{"last_known_affected_version_range":"<= 4.1.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-hr2v-4r36-88hr/GHSA-hr2v-4r36-88hr.json"}},{"package":{"name":"helm.sh/helm/v3","ecosystem":"Go","purl":"pkg:golang/helm.sh/helm/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.20.2"}]}],"database_specific":{"last_known_affected_version_range":"<= 3.20.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-hr2v-4r36-88hr/GHSA-hr2v-4r36-88hr.json"}}],"references":[{"type":"WEB","url":"https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35206"},{"type":"WEB","url":"https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436"},{"type":"PACKAGE","url":"https://github.com/helm/helm"},{"type":"WEB","url":"https://github.com/helm/helm/releases/tag/v4.1.4"}],"database_specific":{"cwe_ids":["CWE-22"],"github_reviewed":true,"github_reviewed_at":"2026-04-10T15:33:09Z","nvd_published_at":"2026-04-09T21:16:09Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}