CVE-2022-25856

7.5 highEPSS 1.9%

High (7.5) in argo events project argo events. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in github.com/argoproj/argo-events 1.7.1.

The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ...

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWEs: CWE-22, CWE-59
Published: 2022-06-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

argo_events_project:argo_events

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-qpgx-64h2-gc3c	Go	github.com/argoproj/argo-events	<1.7.1	1.7.1
GO-2022-0492	Go	github.com/argoproj/argo-events	<1.7.1	1.7.1

References

Check your stack JSON