CVE-2021-25282: Directory Traversal Vulnerability in SaltStack Salt

salt Updated 02 Oct 2025

Summary

27/02/2021

Disclosed on

CVE-2021-25282

CVE

Yes i

Fix available

High

Severity

9.1

CVSS Score

CVE-2021-25282: An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. Affects salt across 15 version ranges.

< 2015.8.10 >= 2015.8.11, < 2015.8.13 >= 2016.3.0, < 2016.3.4 >= 2016.3.5, < 2016.3.6 >= 2016.3.7, < 2016.3.8 >= 2016.11.0, < 2016.11.3 >= 2016.11.4, < 2016.11.5 >= 2016.11.7, < 2016.11.10 >= 2017.7.0, < 2017.7.8 >= 2018.3.0rc1, < 2019.2.0rc1 >= 2019.2.0, < 2019.2.5 >= 2019.2.6, < 2019.2.8 >= 3000, < 3000.6 >= 3001, < 3001.4 >= 3002, < 3002.5

Fixed in 15 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

SaltStack Salt is an open-source configuration management and remote execution tool. It is widely used for managing and automating the configuration of servers and network devices. The vulnerability identified as CVE-2021-25282 allows an attacker to perform directory traversal attacks through the salt.wheel.pillar_roots.write method.

Vulnerability Detail

The salt.wheel.pillar_roots.write method in SaltStack Salt before version 3002.5 is susceptible to directory traversal. This means that an attacker can manipulate the input to the method and access files outside of the intended directory. By exploiting this vulnerability, an attacker can potentially read, modify, or delete sensitive files on the system. This can lead to unauthorized access, data leakage, or even complete system compromise.

How To Fix

Latest published version: 3008.3.0 as of 22 Oct 2026

pip install --upgrade "salt==3008.3.0"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 2015.8.10 2015.8.10
```
pip install --upgrade "salt==2015.8.10"
```
>= 2015.8.11, < 2015.8.13 2015.8.13
```
pip install --upgrade "salt==2015.8.13"
```
>= 2016.3.0, < 2016.3.4 2016.3.4
```
pip install --upgrade "salt==2016.3.4"
```
>= 2016.3.5, < 2016.3.6 2016.3.6
```
pip install --upgrade "salt==2016.3.6"
```
>= 2016.3.7, < 2016.3.8 2016.3.8
```
pip install --upgrade "salt==2016.3.8"
```
>= 2016.11.0, < 2016.11.3 2016.11.3
```
pip install --upgrade "salt==2016.11.3"
```

Show all 15 release lines

>= 2016.11.4, < 2016.11.5 2016.11.5
```
pip install --upgrade "salt==2016.11.5"
```

>= 2016.11.7, < 2016.11.10 2016.11.10

pip install --upgrade "salt==2016.11.10"

>= 2017.7.0, < 2017.7.8 2017.7.8
```
pip install --upgrade "salt==2017.7.8"
```
>= 2018.3.0rc1, < 2019.2.0rc1 2019.2.0rc1
```
pip install --upgrade "salt==2019.2.0rc1"
```
>= 2019.2.0, < 2019.2.5 2019.2.5
```
pip install --upgrade "salt==2019.2.5"
```
>= 2019.2.6, < 2019.2.8 2019.2.8
```
pip install --upgrade "salt==2019.2.8"
```
>= 3000, < 3000.6 3000.6
```
pip install --upgrade "salt==3000.6"
```
>= 3001, < 3001.4 3001.4
```
pip install --upgrade "salt==3001.4"
```
>= 3002, < 3002.5 3002.5
```
pip install --upgrade "salt==3002.5"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. The workaround involves restricting access to the salt.wheel.pillar_roots.write method or disabling it altogether. By limiting access to this method, the risk of exploitation can be mitigated. However, it is important to note that this is only a temporary solution and upgrading to the latest version is still recommended.

Conclusion

The directory traversal vulnerability in SaltStack Salt (CVE-2021-25282) can have serious security implications. It is crucial to upgrade to the latest version (3002.5 or later) to ensure the vulnerability is patched. If immediate upgrade is not possible, implementing the provided workaround can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for salt →

FAQ

What is SaltStack Salt?

SaltStack Salt is an open-source configuration management and remote execution tool used for managing and automating the configuration of servers and network devices.

What is directory traversal?

Directory traversal is a vulnerability that allows an attacker to access files or directories outside of the intended scope. In this case, the vulnerability allows an attacker to manipulate the input to the salt.wheel.pillar_roots.write method and access files outside of the specified directory.

What are the potential consequences of this vulnerability?

Exploiting this vulnerability can lead to unauthorized access, data leakage, or even complete system compromise. An attacker can read, modify, or delete sensitive files on the system, potentially exposing sensitive information or disrupting the normal operation of the system.

How can I fix this vulnerability?

To fix this vulnerability, it is recommended to upgrade SaltStack Salt to version 3002.5 or later. This version includes a fix for the directory traversal vulnerability. Upgrading to the latest version ensures that the vulnerable code is patched and the system is protected against potential attacks.

Is there a workaround available?

References

Related vulnerabilities

Recent vulnerabilities recorded for salt.

View all salt vulnerabilities →