{"cve":"CVE-2022-24904","nvd":{"published":"2022-05-20T14:15:09.283","modified":"2026-06-17T04:32:46.277","status":"Modified","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. Users of versions 2.3.0 or above who do not have any Jsonnet/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-59","CWE-61"],"references":["https://github.com/argoproj/argo-cd/releases/tag/v2.1.15","https://github.com/argoproj/argo-cd/releases/tag/v2.2.9","https://github.com/argoproj/argo-cd/releases/tag/v2.3.4","https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h","https://github.com/argoproj/argo-cd/releases/tag/v2.1.15"],"products":["argoproj:argo_cd"],"source":"nvd","synced_at":"2026-10-19T21:31:59.322382750+00:00"},"epss":{"cve":"CVE-2022-24904","score":0.01151,"percentile":0.66915,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-6gcg-hp2x-q54h","url":"https://osv.dev/vulnerability/GHSA-6gcg-hp2x-q54h","summary":"Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server","modified":"2026-10-21T03:11:56.153993529Z","packages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":["<2.1.15"],"fixed":["2.1.15"]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":[">=2.2.0 <2.2.9"],"fixed":["2.2.9"]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":[">=2.3.0 <2.3.4"],"fixed":["2.3.4"]}]},{"id":"GO-2022-0453","url":"https://osv.dev/vulnerability/GO-2022-0453","summary":"Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server in github.com/argoproj/argo-cd","modified":"2026-03-03T04:50:23.862917Z","packages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","purl":"pkg:golang/github.com/argoproj/argo-cd","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":["<2.1.15",">=2.2.0 <2.2.9",">=2.3.0 <2.3.4"],"fixed":["2.1.15","2.2.9","2.3.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}