A craftable Chart that contains a name with a dot‑segment can cause the Helm pull and untar operation to write files into the immediate working directory instead of the intended chart subdirectory. This results in arbitrary file placement or overwrite within the local file system where Helm is executed, potentially allowing a local attacker to replace or corrupt configuration files. The weakness is a file path traversal issue, classified as CWE‑22.

Helm, the package manager for Kubernetes charts, is affected in all releases older than v3.20.2 and v4.1.4. The issue appears in Helm versions 3.20.1 and earlier and 4.1.3 and earlier. Updating to 3.20.2 or any newer 3.x release, or to 4.1.4 or newer 4.x releases, removes the vulnerability.

The CVSS score of 4.8 indicates a medium severity risk. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker supply or influence the Chart pulled by Helm; thus the attack vector is local to the user running Helm. An attacker who can trick a Helm client into pulling a malicious chart may place files at an arbitrary path within the user’s workspace, which could lead to privilege escalation or disrupt service operation.