argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links

8.1 CVSS

Vulnerability Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the subsequent check are flawed. An attacker can overwrite the file /var/run/argo/argoexec with a script of their choice, which would be executed at the pod's start. The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. This issue is fixed in versions 3.6.14 and 3.7.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66626

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from argoproj

View All →

CVE-2025-62157

Argo Workflows exposes artifact repository credentials in workflow-controller logs

High 8.5

CVE-2025-62156

argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite

High 8.1

CVE-2025-59538

Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

High 7.5

CVE-2025-59537

argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload

High 7.5

CVE-2025-59531

Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

High 7.5

Affected Vendor

argoproj

View all reports →

Affected Software

argo-workflows

Vulnerable Versions:

github.com/argoproj/argo-workflows/v3 >= 3.7.0, < 3.7.5, github.com/argoproj/argo-workflows/v3 < 3.6.14, github.com/argoproj/argo-workflows <= 2.5.3-rc4