CVE-2022-25856High· 7.5▾ TwilightInsecure path traversal in Git Trigger Source can lead to arbitrary file read
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.8%
1.8% → 1.9%
A path traversal issue was found in the (g *GitArtifactReader).Read() API. Read() calls into (g *GitArtifactReader).readFromRepository() that opens and reads the file that contains the trigger resource definition:
func (g *GitArtifactReader) readFromRepository(r *git.Repository, dir string)
No checks are made on this file at read time, which could lead an attacker to read files anywhere on the system. This could be achieved by either using symbolic links, or putting ../ in the path.
A patch for this vulnerability has been released in the following Argo Events version:
v1.7.1
Disclosed by Ada Logics in a security audit sponsored by CNCF and facilitated by OSTIF.
Open an issue in the Argo Events issue tracker or discussions Join us on Slack in channel #argo-events
github.com/argoproj/argo-events < 1.7.1Upgrade to a patched release:
github.com/argoproj/argo-events 1.7.1Connected by shared product, vendor, weakness, or advisory.
CVE-2024-37152Medium· 5.3Unauthenticated Access to sensitive settings in Argo CD
CVE-2024-21661High· 7.5Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
CVE-2023-22736High· 8.5Controller reconciles apps outside configured namespaces when sharding is enabled
CVE-2023-40026Medium· 5.0Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
CVE-2026-40886High· 7.7Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller
CVE-2026-28229High· 7.5Unauthorized access to Argo Workflows Template