CVE-2012-3865: Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2...

Security readout for executives and security teams

This flaw affects old Puppet and Puppet Enterprise masters. If a trusted/authenticated client can use Delete in auth.conf, a crafted node name could make the master delete files outside the intended report path. The main business risk is disruption or damage to configuration management infrastructure. Exposure is most likely in legacy Puppet master deployments that still run the affected versions and permit Delete in auth.conf. Modern or upgraded Puppet installations are not shown as affected by the provided sources. Prioritize remediation where Puppet manages production infrastructure or sensitive systems. The issue is old and conditional, but arbitrary file deletion on a management server can create operational outages and recovery costs. Mitigation focus: Upgrade Puppet to 2.6.17 or 2.7.18 or later.; Upgrade Puppet Enterprise to 2.5.2 or later.; Review auth.conf and disable Delete unless explicitly required..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.