Path Traversal

2022-03-2405:05:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

argocd

path traversal

vulnerability

resolvesymboliclinkrecursive

repository.go

malicious user

sensitive information

software

EPSS

0.001

Percentile

40.2%

JSON

github.com/argoproj/argo-cd is vulnerable to path traversal. The vulnerability exists in the resolveSymbolicLinkRecursive function of the repository.go, which allows a malicious user with write and update permissions to craft malicious Helm chart and gain access to sensitive information in the system.