CVE-2025-24513
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2025-03-25

Last updated on: 2026-06-17

Assigner: Kubernetes

Description
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-03-25
Last Modified
2026-06-17
Generated
2026-10-16
AI Q&A
2025-03-25
EPSS Evaluated
2026-10-14
NVD
CVE-2025-24513

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kubernetes ingress-nginx 0
kubernetes ingress-nginx 1.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-24513 is a vulnerability identified in the ingress-nginx controller, specifically related to an authentication secret file path traversal issue. The vulnerability arises from the ingress-nginx Admission Controller feature, which allows attacker-provided data to be included in a filename, leading to potential directory traversal within the container. [1]

Detection Guidance

Users should check if ingress-nginx is installed by running the command `kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx`. Affected versions include any version below v1.11.0, as well as v1.11.0 to v1.11.4 and v1.12.0. [1]

Impact Analysis

This vulnerability could result in a denial of service or, when combined with other vulnerabilities, limited disclosure of Secret objects from the Kubernetes cluster. [1]

Mitigation Strategies

To mitigate this vulnerability, it is required to upgrade ingress-nginx to version v1.11.5, v1.12.1, or any later version. As a temporary measure, users can disable the Validating Admission Controller functionality of ingress-nginx before applying the patch. [1]

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-24513. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart