CVE Watch—

CVE-2020-11652

SaltStack Salt Path Traversal Vulnerability

CVSS

—

No CVSS

EPSS

86.2%

p100

KEV

YES

Nov 3, 2021

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

86.2%EPSS · 30 days86.2%

2026-09-162026-10-14

KEV catalog record

Product

SaltStack / Salt

Vulnerability

SaltStack Salt Path Traversal Vulnerability

Added to KEV

Nov 3, 2021

Remediate by

May 3, 2022

Known ransomware use

Summary description

SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-11652

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2020-16846—

99.9%

KEV—80SaltStack Salt Shell Injection Vulnerability—CVE-2020-11651—

99.9%

KEV—80SaltStack Salt Authentication Bypass Vulnerability—