CVSS 3.1
4.8 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:LCVE-2025-24513
Medium (4.8). EPSS 3.3% chance of exploitation in the next 30 days. Fixed in k8s.io/ingress-nginx 1.11.5, 1.12.1.
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
Severity
- EPSS
- 3.3% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-242m-6h72-7hgp | Go | k8s.io/ingress-nginx | <1.11.5 | 1.11.5 |
| GHSA-242m-6h72-7hgp | Go | k8s.io/ingress-nginx | >=1.12.0-beta.0 <1.12.1 | 1.12.1 |
| GO-2025-3564 | Go | k8s.io/ingress-nginx | all versions | no fix published |