CVE-2026-35206 is a path traversal vulnerability in Helm used by Red Hat Advanced Cluster Management for Kubernetes. The flaw allows a remote attacker to supply a malicious Chart to the helm pull --untar command, resulting in files being written to unintended directories. This can overwrite existing files or place malicious files in locations accessible to users, potentially compromising data integrity and availability. The vulnerability is tracked under multiple CWEs including CWE-22 (Path Traversal) and others related to integrity and availability impacts. Red Hat has issued a security advisory and updated container images in version 2.13.9 to address this vulnerability.

Exploitation of this vulnerability can lead to unauthorized modification or creation of files outside the intended directory, potentially overwriting critical system or application files. This may cause denial of service by corrupting essential files or allow attackers to place malicious files that could be executed or accessed, impacting system integrity and availability. Confidentiality impact is considered low as the vulnerability primarily affects file write paths. No known active exploitation has been reported.

Red Hat has released version 2.13.9 of Advanced Cluster Management for Kubernetes containing updated container images that fix this vulnerability. Users should upgrade to version 2.13.9 or later to remediate this issue. Prior to applying the update, ensure all previously released relevant errata are applied. Refer to Red Hat's official update instructions for proper patch application. No additional mitigations are specified by the vendor.