4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-22238

CVE-2025-22238: Salt vulnerable to directory traversal attack in minion file cache creation

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-22238

CVE-2025-22238:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salt	pip	>= 3006.0rc1, < 3006.12	3006.12
salt	pip	>= 3007.0rc1, < 3007.4	3007.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2025-22238 is a directory traversal issue in SaltStack's minion file cache creation process. The analysis of the commit 4b30218edf1a979855ea191d72b30c89f4a5a582 reveals two key functions involved:

salt.returners.local_cache.save_minions: This function is directly responsible for the vulnerability. It constructs file paths for caching job-related minion data. Prior to the patch, it used os.path.join to combine a base directory (jid_dir, derived from the job ID) and a filename (derived from syndic_id or a constant). Crucially, it lacked proper sanitization of these components. If an attacker could control parts of the jid or syndic_id to include path traversal sequences (e.g., ../), they could cause the system to write or overwrite cache files outside of the intended base cache directory. The patch addresses this by introducing salt.utils.verify.clean_join, which incorporates stronger path validation using an improved clean_path and pathlib.Path.resolve() checks.
salt.utils.verify.clean_path (previous version): This utility function is designed to clean and validate a given path against a root directory, ensuring it doesn't escape the intended boundary. The commit includes a significant rewrite of clean_path, making its logic for normalization and validation (e.g., using os.path.normpath, _realpath, and os.path.commonpath) more robust. This implies that the previous version of clean_path was insufficient and could be bypassed in certain scenarios, making it a contributing factor if it had been used (or if its perceived security led to lax practices). The vulnerability in save_minions was effectively due to not employing a mechanism as robust as the newly patched clean_path (via clean_join).

The root cause of the vulnerability is improper limitation of a pathname to a restricted directory (CWE-22). Specifically, it's due to insufficient sanitization and validation of user-controllable inputs used in file path construction within the caching mechanism. The exploit could allow an attacker with permissions to influence job IDs or syndic IDs to write files to arbitrary locations on the master server that are writable by the Salt master process, limited by the cache directory's parent structure.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.