CVE-2025-24513

Vulnerability

Overview

CVE-2025-24513 is a directory traversal vulnerability in the ingress-nginx Admission Controller. The flaw arises because attacker-provided data is included in a filename without proper sanitization, enabling directory traversal within the container [1]. This means an attacker who can submit a crafted Ingress resource can cause the controller to read or write files outside the intended directory.

Exploitation

An attacker needs network access to the Kubernetes API server and the ability to create or update Ingress resources. No authentication bypass is required, but the attacker must have permissions to submit Ingress objects. The traversal is limited to the filesystem within the container, but it can be used to overwrite files or cause the controller to access arbitrary paths [1].

Impact

If exploited, the vulnerability can result in denial of service by corrupting configuration files or crashing the controller. Furthermore, when combined with other vulnerabilities, it may enable limited disclosure of Kubernetes Secret objects that are mounted or readable within the container [1]. The CVSS v3.1 base score is 4.8 (Medium), reflecting the moderate impact and attack complexity.

Mitigation

The vulnerability is fixed in ingress-nginx controller versions v1.12.1 [2] and v1.11.5 [3]. Administrators should update to these versions or later. The release notes for both fixes also mention that to address a related issue (CVE-2025-1974), validation of the generated NGINX configuration during Ingress validation is disabled, but the configuration is still checked before loading [2][3]. Users are advised to enable annotation validation and disable snippet annotations to reduce risk.