8.1

CVE-2024-5154: kubernetes cri-o Path Traversal

CVSS: 8.1v3.1HighModified
AliasesRHSA-2024:3676RHSA-2024:3700RHSA-2024:4008
Published 12-06-2024Last modified 21-08-2026
Open JSON

Vulnerability summary

CVE-2024-5154 is a high (CVSS 8.1) Path Traversal vulnerability in kubernetes cri-o. EPSS estimates a 1.24% chance of exploitation in the next 30 days, higher than 68.6% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
1.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1
RHSA-2024:4159

Timeline

  1. 12-06-2024
    PublishedVulnerability first disclosed.
  2. 21-08-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

1.24%

Chance of exploitation in the next 30 days

Percentile

69%

Versus all other CVEs

30-day change

0.00 pp

From 1.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat4 products
  • openshift_container_platform3.11 | 4.0 | 4.12 | 4.13 | 4.14 | 4.15
  • cri-o< 0:1.28.7-2.rhaos4.15.git111aec5.el8 | < 0:1.28.7-2.rhaos4.15.git111aec5.el9 | < 0:1.27.7-3.rhaos4.14.git674563e.el8 | < 0:1.27.7-3.rhaos4.14.git674563e.el9 | < 0:1.25.5-21.2.rhaos4.12.gita3eb75f.el8 | < 0:1.26.5-18.2.rhaos4.13.git2e90133.el8 | < 0:1.26.5-18.2.rhaos4.13.git2e90133.el9
  • cri-o-debuginfo< 0:1.28.7-2.rhaos4.15.git111aec5.el8 | < 0:1.28.7-2.rhaos4.15.git111aec5.el9 | < 0:1.27.7-3.rhaos4.14.git674563e.el8 | < 0:1.27.7-3.rhaos4.14.git674563e.el9 | < 0:1.25.5-21.2.rhaos4.12.gita3eb75f.el8 | < 0:1.26.5-18.2.rhaos4.13.git2e90133.el8 | < 0:1.26.5-18.2.rhaos4.13.git2e90133.el9
  • cri-o-debugsource< 0:1.28.7-2.rhaos4.15.git111aec5.el8 | < 0:1.28.7-2.rhaos4.15.git111aec5.el9 | < 0:1.27.7-3.rhaos4.14.git674563e.el8 | < 0:1.27.7-3.rhaos4.14.git674563e.el9 | < 0:1.25.5-21.2.rhaos4.12.gita3eb75f.el8 | < 0:1.26.5-18.2.rhaos4.13.git2e90133.el8 | < 0:1.26.5-18.2.rhaos4.13.git2e90133.el9
Github.com/cri-o1 product
  • cri-o≥ 1.28.6, < 1.28.7 | ≥ 1.29.4, < 1.29.5 | ≥ 1.30.0, < 1.30.1
Kubernetes1 product
  • cri-o1.28.6 | 1.29.4 | 1.30.0

3 vendors · 6 products

References

18 links
Show all 18 references