CVE-2022-24348
Path traversal and dereference of symlinks in Argo CD
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
- Record
CVE-2022-24348- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
- Record
CVE-2022-24348- Updated
- 2026-11-02
EUVDEUVD-2022-0851 No score
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
- Record
EUVD-2022-0851- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-63qx-x74g-jcr7
Path traversal and dereference of symlinks in Argo CD
Impact
All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts.
Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files outside the repository's root directory.
If an attacker with permissions to create or update Applications knows or can guess the full path to a file containing valid YAML, they can create a malicious Helm chart to consume that YAML as values files, thereby gaining access to data they would otherwise have no access to.
The impact can especially become critical in environments that make use of encrypted value files (e.g. using plugins with git-crypt or SOPS) containing sensitive or confidential data, and decrypt these secrets to disk before rendering the Helm chart.
Also, because any error message from helm template is passed back to the user, and these error messages are quite verbose, enumeration of files on the repository server's file system is possible.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:
- v2.3.0
- v2.2.4
- v2.1.9
We urge users of Argo CD to update their installation to one of the fixed versions as listed above.
Workarounds
No workaround for this issue.
References
- https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24348
For more information
- Open an issue in the Argo CD issue tracker or discussions
- Join us on Slack in channel
#argo-cd
Credits
The path traversal vulnerability was discovered and reported by Moshe Zioni, VP Security Research, Apiiro.
During the development of a fix for the path traversal vulnerability, the Argo CD team discovered the related issue with symbolic links.
The Argo CD team would like to thank Moshe Zioni for the responsible disclosure, and the constructive discussions during handling this issue!
- Record
GHSA-63qx-x74g-jcr7- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-22, CWE-200
- Updated
- 2026-11-02
OSVGHSA-63qx-x74g-jcr7
Path traversal and dereference of symlinks in Argo CD
Impact
All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts.
Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files outside the repository's root directory.
If an attacker with permissions to create or update Applications knows or can guess the full path to a file containing valid YAML, they can create a malicious Helm chart to consume that YAML as values files, thereby gaining access to data they would otherwise have no access to.
The impact can especially become critical in environments that make use of encrypted value files (e.g. using plugins with git-crypt or SOPS) containing sensitive or confidential data, and decrypt these secrets to disk before rendering the Helm chart.
Also, because any error message from helm template is passed back to the user, and these error messages are quite verbose, enumeration of files on the repository server's file system is possible.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:
- v2.3.0
- v2.2.4
- v2.1.9
We urge users of Argo CD to update their installation to one of the fixed versions as listed above.
Workarounds
No workaround for this issue.
References
- https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24348
For more information
- Open an issue in the Argo CD issue tracker or discussions
- Join us on Slack in channel
#argo-cd
Credits
The path traversal vulnerability was discovered and reported by Moshe Zioni, VP Security Research, Apiiro.
During the development of a fix for the path traversal vulnerability, the Argo CD team discovered the related issue with symbolic links.
The Argo CD team would like to thank Moshe Zioni for the responsible disclosure, and the constructive discussions during handling this issue!
- Record
GHSA-63qx-x74g-jcr7- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-200, CWE-22
- Updated
- 2026-11-02
OSV No score
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
- Record
CVE-2022-24348- Updated
- 2026-11-02
OSVGO-2022-0304 No score
Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd
Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd
- Record
GO-2022-0304- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/argoproj/argo-cd/v2Go |
before 2.1.9 | 2.1.9 |
github.com/argoproj/argo-cd/v2Go |
2.2.0 up to 2.2.4 | 2.2.4 |
github.com/argoproj/argo-cdGo |
before 2.1.9 | 2.1.9 |
github.com/argoproj/argo-cdGo |
All versions | None known |
github.com/argoproj/argo-cd/v2Go |
before 2.1.9, 2.2.0 up to 2.2.4 | 2.1.92.2.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | DeveloperOl/CVE-2022-24348-2 | 2022-02-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24348 is a high vulnerability (CVSS 7.7) in Argoproj Argo Cd, published February 4, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.77%, the 86th percentile. Fixed in github.com/argoproj/argo-cd/v2 2.1.9.
References
apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments
github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7
nvd.nist.gov/vuln/detail/CVE-2022-24348