Puppet vulnerable to Path Traversal

published 2012-08-06 14 y ago modified 2026-06-16 4 mo ago also GHSA-g89m-3wjw-h857 , EUVD-2017-0235

cvss: 3.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.

Patch / fix

fixed in 1 distros 1 links 2

rubygems puppet 2.6.17, 2.7.18

puppet Debian 11 2.7.18-1

debian advisories DEBIAN-CVE-2012-3865

github.com/puppetlabs/puppet@554eefc commit
github.com/puppetlabs/puppet@d804782 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-3865 updated 2026-01-28 cvss 2.1

puppet: authenticated clients allowed to delete arbitrary files on the puppet master

Red Hat Enterprise MRG 1 puppet
affected: no fix planned “Will not fix”
Red Hat CloudForms Cloud Engine for RHEL 6 Server puppet 2.6.17-2.el6cf, rubygem-mail 2.3.0-3.el6cf, puppet-server 2.6.17-2.el6cf, rubygem-compass 0.11.5-2.el6cf, rubygem-net-ldap 0.1.1-3.el6cf, rubygem-chunky_png 1.2.0-3.el6cf, +6 more Red Hat CloudForms System Engine for RHEL 6 Server puppet 2.6.17-2.el6cf, rubygem-mail 2.3.0-3.el6cf, puppet-server 2.6.17-2.el6cf, rubygem-compass 0.11.5-2.el6cf, rubygem-net-ldap 0.1.1-3.el6cf, rubygem-chunky_png 1.2.0-3.el6cf, +6 more
fixed: vendor fix RHSA-2012:1542

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.88% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

github.com https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	3.5	AV:N/AC:M/Au:S/C:N/I:N/A:P

Affected packages

ecosystem	package	affected	fixed in
rubygems	puppet	<2.6.17 >=2.7.0, <2.7.18	2.6.17 2.7.18

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

github.com /puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f
web, exploit, patch
github.com /puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6
web, exploit, patch
lists.opensuse.org /opensuse-security-announce/2012-08/msg00006.html
vendor-advisory, web
debian.org /security/2012/dsa-2511
vendor-advisory, web
ubuntu.com /usn/USN-1506-1
vendor-advisory, web
lists.opensuse.org /opensuse-updates/2012-07/msg00036.html
vendor-advisory, web
puppetlabs.com /security/cve/cve-2012-3865/
vendor-advisory
secunia.com /advisories/50014
third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=839131
web
nvd.nist.gov /vuln/detail/CVE-2012-3865
advisory
github.com /puppetlabs/puppet
package
github.com /rubysec/ruby-advisory-db/blob/master/gems/CVE-2012-3865.yml
web
github.com /rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3865.yml
web
puppet.com /security/cve/overview-cve-2012-3865-arbitrary-file-delete/dos-puppet-master
web
puppetlabs.com /security/cve/cve-2012-3865
web

Sources

CVE List CVE-2012-3865
GitHub Advisory GHSA-g89m-3wjw-h857
NVD CVE-2012-3865

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary