Skip to content
Heist/ feed
Back to feed
Medium

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Type: advisorySources: OSV

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-35206
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 10:52 UTC · Revision 1

Source evidence

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

core-osv · Original source

Published 9 Apr 2026, 21:02 UTC

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

osv:CVE-2026-35206
Complete source record
{
  "id": "46eadcf72e571d9e7a0f189bbff72336447bc26fb1766c2679ee34d5c92f13c7",
  "url": "https://osv.dev/vulnerability/CVE-2026-35206",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment",
    "summary": "Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.",
    "evidence": "osv:CVE-2026-35206",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-35206",
      "aliases": [
        "BIT-helm-2026-35206",
        "CVE-2026-35206",
        "GHSA-hr2v-4r36-88hr",
        "GO-2026-5435"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/helm/helm",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "8fb76d6ab555577e98e23b7500009537a471feee"
                },
                {
                  "introduced": "99cd1964357c793351be481d55abbe21c6b2f4ec"
                },
                {
                  "fixed": "05fa37973dc9e42b76e1d2883494c87174b6074f"
                },
                {
                  "fixed": "4e7994d4467182f535b6797c94b5b0e994a91436"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.20.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "4.0.0"
                      },
                      {
                        "fixed": "4.1.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "4e7994d4467182f535b6797c94b5b0e994a91436"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "05fa37973dc9e42b76e1d2883494c87174b6074f"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v4.1.4"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.20.1",
            "v4.1.3",
            "v3.20.0-rc.1",
            "v3.20.0",
            "v4.1.2",
            "v4.1.1",
            "v4.1.0-rc.1",
            "v4.1.0",
            "v4.0.0-rc.1",
            "v4.0.0",
            "v3.12.0-dev.1",
            "v3.0.0-beta.5",
            "v3.0.0-beta.4",
            "v3.0.0-beta.3",
            "v3.0.0-beta.2",
            "v3.0.0-beta.1",
            "v3.0.0-alpha.2",
            "v3.0.0-alpha.1",
            "v2.8.0-rc.1",
            "v2.7.0",
            "v2.7.0-rc1",
            "v2.6.0",
            "v2.5.0",
            "v2.4.0",
            "v2.3.0",
            "v2.2.0",
            "v2.1.0",
            "v2.0.0",
            "v2.0.0-rc.2",
            "v2.0.0-rc.1",
            "v2.0.0-beta.2",
            "v2.0.0-beta.1",
            "v2.0.0-alpha.5",
            "v2.0.0-alpha.4",
            "v2.0.0-alpha.2",
            "v2.0.0-alpha.1",
            "1.999.0",
            "v1.2",
            "v1.1",
            "v1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35206.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:28.200697508Z",
      "provider": "osv",
      "references": [
        "https://github.com/helm/helm/releases/tag/v4.1.4",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35206.json",
        "https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-35206",
        "https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35206.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-35206",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 494679,
  "published_at": "2026-04-09T21:02:13.594+00:00"
}