diff --git a/0006-backport-CVE-2024-10220.patch b/0006-backport-CVE-2024-10220.patch
new file mode 100644
index 0000000000000000000000000000000000000000..f1dcf6587fa6d0ecbea3aeb663bd2bd25088c903
--- /dev/null
+++ b/0006-backport-CVE-2024-10220.patch
@@ -0,0 +1,50 @@
+commit c7846fd24c16266a3bfd86315171f5b4d5f0c9c9
+Author: Imre Rad <imrer@google.com>
+Date:   Thu Apr 25 14:21:51 2024 +0000
+
+    gitRepo volume: directory must be max 1 level deep
+    
+    More details on Hackerone #2266560
+
+diff --git a/pkg/volume/git_repo/git_repo.go b/pkg/volume/git_repo/git_repo.go
+index 995018d9007..b3827b92ad0 100644
+--- a/pkg/volume/git_repo/git_repo.go
++++ b/pkg/volume/git_repo/git_repo.go
+@@ -261,6 +261,12 @@ func validateVolume(src *v1.GitRepoVolumeSource) error {
+ 	if err := validateNonFlagArgument(src.Directory, "directory"); err != nil {
+ 		return err
+ 	}
++	if (src.Revision != "") && (src.Directory != "") {
++		cleanedDir := filepath.Clean(src.Directory)
++		if strings.Contains(cleanedDir, "/") || (strings.Contains(cleanedDir, "\\")) {
++			return fmt.Errorf("%q is not a valid directory, it must not contain a directory separator", src.Directory)
++		}
++	}
+ 	return nil
+ }
+ 
+diff --git a/pkg/volume/git_repo/git_repo_test.go b/pkg/volume/git_repo/git_repo_test.go
+index 5b1461be892..650f765cc48 100644
+--- a/pkg/volume/git_repo/git_repo_test.go
++++ b/pkg/volume/git_repo/git_repo_test.go
+@@ -267,6 +267,20 @@ func TestPlugin(t *testing.T) {
+ 			},
+ 			isExpectedFailure: true,
+ 		},
++		{
++			name: "invalid-revision-directory-combo",
++			vol: &v1.Volume{
++				Name: "vol1",
++				VolumeSource: v1.VolumeSource{
++					GitRepo: &v1.GitRepoVolumeSource{
++						Repository: gitURL,
++						Revision:   "main",
++						Directory:  "foo/bar",
++					},
++				},
++			},
++			isExpectedFailure: true,
++		},
+ 	}
+ 
+ 	for _, scenario := range scenarios {
diff --git a/kubernetes.spec b/kubernetes.spec
index 2b42e36f556e2934ceda514d5a4d84eaab83d52c..8916642a3a7c8928c5f67b187f4318cedab5a052 100644
--- a/kubernetes.spec
+++ b/kubernetes.spec
@@ -3,7 +3,7 @@
 
 Name:         kubernetes
 Version:      1.29.1
-Release:      7
+Release:      8
 Summary:      Container cluster management
 License:      ASL 2.0
 URL:          https://k8s.io/kubernetes
@@ -29,6 +29,7 @@ Patch0002: 0002-kubelet-support-exec-and-attach-websocket-protocol.patch
 Patch0003: 0003-Add-envFrom-to-serviceaccount-admission-plugin.patch
 Patch0004: 0004-Add-processStartTime-in-metrics-slis.patch
 Patch0005: 0005-fix-a-bug-where-the-uploaded-kubelet-configuration-in-kube-system-kubelet-config-ConfigMap-does-not-respect-user.patch
+Patch0006: 0006-backport-CVE-2024-10220.patch
 %ifarch riscv64
 Patch1000: 1000-Add-riscv64-support-for-v1.29.1-kubernetes.patch
 %endif
@@ -273,6 +274,9 @@ getent passwd kube >/dev/null || useradd -r -g kube -d / -s /sbin/nologin \
 %systemd_postun kubelet kube-proxy
 
 %changelog
+* Mon Nov 25 2024 Yu Peng <yupeng@kylinos.cn> - 1.29.1-8
+- Fixed CVE-2024-10220.
+
 * Tue Jul 9 2024 zhangxingrong-<zhangxingrong@uniontech.cn> - 1.29.1-7
 - DESC:Round Upstream Patchs