CVE-2022-24348 Path traversal and dereference of symlinks in Argo CD

What is CVE-2022-24348?

CVE-2022-24348 is a high-severity path traversal vulnerability in Argoproj Argo Cd, published on 4 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.

Weakness: CWE-22

Which versions are affected by CVE-2022-24348?

8 open source packages ship an affected version, including github.com/argoproj/argo-cd/v2 and github.com/argoproj/argo-cd. It affects 1 product.

Products include Argoproj Argo Cd.

How do I fix CVE-2022-24348?

Upgrade github.com/argoproj/argo-cd/v2 to a fixed version for your release line: 2.1.9 or 2.2.4.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-24348 being exploited?

There is no known exploitation of CVE-2022-24348 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Argoproj Argo Cd

• CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials Critical 10.0
• CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled Critical 10.0
• CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD Critical 9.9
• CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD Critical 9.9
• CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss Critical 9.8

All Argoproj Argo Cd vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-63qx-x74g-jcr7, GO-2022-0304.