{"action":"Upgrade salt to 2017.7.8 or later.","affected":[{"fixed":"2017.7.8","introduced":"0"},{"fixed":"2018.3.3","introduced":"2018.3.0"}],"component":"salt","cve_ids":["CVE-2018-15750"],"ecosystem":"PyPI","epss":0.04275,"exploited":false,"fixed_versions":["2017.7.8","2018.3.3"],"ghsa_id":"GHSA-jx34-pppm-gjvr","id":"tcs_01M5KG7X0HG30JBVGV1QAN3NRN","modified_at":"2026-06-10T17:02:37.810253795Z","published_at":"2018-10-24T22:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-29","https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ","https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ","https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html","https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html","https://usn.ubuntu.com/4459-1/","https://github.com/advisories/GHSA-jx34-pppm-gjvr"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2018-29","url":"https://osv.dev/vulnerability/PYSEC-2018-29"},{"source":"nvd","source_id":"CVE-2018-15750","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15750"}],"summary":"Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server."}