CVE-2021-25741 HIGH

CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access

Vendor Kubernetes
Product Kubernetes
Weakness CWE-20 · Input validation
Published September 20, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

Key dates

02Disclosure timeline

September 20, 2021 CVE published
September 16, 2024 Record updated