Argo Workflow hat eine Zipslip Vulnerability in github.com/argoproj/argo-workflows

The Zipslip vulnerability in Argo Workflows allows an attacker to craft a malicious archive that, when extracted by Argo Workflows, can write files to arbitrary locations on the server. This is achieved by manipulating the paths within the archive to include directory traversal sequences (e.g., ../../). Successful exploitation could lead to the attacker gaining control over sensitive files, potentially including configuration files, credentials, or even executable code. The blast radius extends to any system where Argo Workflows is deployed and processes user-supplied archives. While no direct precedent exists for this specific Argo Workflows vulnerability, Zipslip vulnerabilities in other contexts, such as unzip utilities, have been exploited to achieve remote code execution and system compromise.

Organizations deploying Argo Workflows in production environments, particularly those handling sensitive data or integrating with other critical systems, are at risk. Environments with older, unpatched versions of Argo Workflows are especially vulnerable. Shared hosting environments where multiple users have access to file upload functionalities also face increased risk.

• go / server:

find /opt/argoworkflows -type f -name '*.zip' -print0 | xargs -0 grep -i '\.\.\\'

• generic web:

curl -I <argo_workflows_url>/path/to/zip/extraction | grep 'Content-Type:'

1. 2025-11-05Disclosure

   disclosure

1. Reserviert2025-10-07
2. Veröffentlicht2025-11-05
3. Geändert2026-02-04
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-62156 is to upgrade Argo Workflows to version 3.6.12 or later. This version includes a fix that prevents the Zipslip vulnerability. If upgrading immediately is not feasible, consider implementing input validation on archive contents to restrict the paths that can be extracted. This could involve whitelisting allowed file extensions and validating that extracted paths remain within a designated directory. Web application firewalls (WAFs) configured to detect and block malicious path traversal attempts could also provide a temporary layer of defense. After upgrading, confirm the fix by attempting to extract a specially crafted archive containing directory traversal sequences and verifying that the extraction fails with an appropriate error message.