CVE-2021-39143

Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system files. This would allow an attacker to override files on the container, POTENTIALLY introducing a MITM type attack vector by replacing libraries or injecting wrapper files. Users are advised to update as soon as possible. For users unable to update disable Google AppEngine deployments and/or disable artifacts that provide TARs.

• CWE-22
• CWE-22

• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-34jx-3vmr-56v8Exploit, Technical Description, Third Party Advisory
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-34jx-3vmr-56v8Exploit, Technical Description, Third Party Advisory

Published

Jan 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39137go-ethereum is the official Go implementation of the Ethereu…7.5
• CVE-2021-39138Parse Server is an open source backend that can be deployed …6.5
• CVE-2021-39139XStream is a simple library to serialize objects to XML and …8.8
• CVE-2021-3914It was found that the smallrye health metrics UI component d…6.1
• CVE-2021-39140XStream is a simple library to serialize objects to XML and …6.3
• CVE-2021-39141XStream is a simple library to serialize objects to XML and …8.5
• CVE-2021-39144XStream is a simple library to serialize objects to XML and …8.5
• CVE-2021-39145XStream is a simple library to serialize objects to XML and …8.5
• CVE-2021-39146XStream is a simple library to serialize objects to XML and …8.5
• CVE-2021-39147XStream is a simple library to serialize objects to XML and …8.5
• CVE-2021-39148XStream is a simple library to serialize objects to XML and …8.5
• CVE-2021-39149XStream is a simple library to serialize objects to XML and …8.5