CVE record
CVE-2026-35206
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.
CVE evidence
Known exploitation
Not listed in fetched KEV catalog
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
moderate
CVSS 4.8 · CVSS_V4
Affected packages
2
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| helm.sh/helm/v4 | go | 4.1.4 |
| helm.sh/helm/v3 | go | 3.20.2 |