CVE-2022-24348

mediumpriority · track · 42EPSS 0.028 · 86 %ileexploit · PoCEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

2.77% (86th) EPSS

CVSS 4 · medium

Is it mine?

34 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedopenshift-gitops-1/applicationset-rhel8@sha256:7027540d0244496785cd368a3802d551f974f5114735966dc4b5846ab70832cb_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0476
Fixedopenshift-gitops-1/argocd-rhel8@sha256:bc5e750413e3806b92a548029010f82aee0bede3b0fe918fd53c280e2384359b_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0476
Fixedopenshift-gitops-1/dex-rhel8@sha256:20a85d451ff3697f5d7c3f55d4776832cdf7a6a90623ce72d481dd6becad3b97_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0476
Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:636a040e83d025996d133fc6f90a625aed2d8bb81db45c23bb8e11d6d5571993_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0476
Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:99cfc9175851012da28592bc238e297a56ed10496bd94c1409f9a87338f2f58d_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0476
Fixedopenshift-gitops-1/gitops-rhel8@sha256:9f1072299358f38ab62bbd74e7d1f8af16b58c927b3e8d0626efaa0382bd4623_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0476
Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:79571b309fbb43ca9141bc4cfa24f4b668ffc9a7947fb3d6d55065f4a71bac8d_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0476
Fixedopenshift-gitops-1/applicationset-rhel8@sha256:8b317cf28ec94757e661e83075ab9ac8397c4940197366ee5e0091d9423f7cc6_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0477
Fixedopenshift-gitops-1/argocd-rhel8@sha256:6ebac7a8e959032d7634d2992e18efdc12668dff7a50cd94d080eb11d08b9c30_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0477
Fixedopenshift-gitops-1/dex-rhel8@sha256:3a3635a1d9782966131d131ab0296c86e7b9f501d2940bab6e7cbcae4255d221_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0477
Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:ad293cc67f56184224dd0b22a6f7653d47ba2e18ce15fd6e510817ff6bd371ba_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0477
Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:5fea603d0f8835221752df1cd30d76a6d59764f9d3be4d6484a5ca59b2cdd90e_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0477
Fixedopenshift-gitops-1/gitops-rhel8@sha256:4342da4644f5aefa762759737c6173dedcd2518ef2a264b2f0d6bdd2465d642d_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0477
Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:097a5325971ee7a7a0a9d2ae45d0adda3bb8df09a3d39e496ebfaf7a19a173a7_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0477
Fixedopenshift-gitops-1/applicationset-rhel8@sha256:de60b8e0019f8cd5900ab934761c289973b8e80f74c7f343e9b8c7bdab35ec7b_amd64 as a component of Red Hat OpenShift GitOps 1.2redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0580
Fixedopenshift-gitops-1/argocd-rhel8@sha256:ba9c8eb1b6ab9633a67f82038a8d597f070e9d1d3bee50bb3944b5ccbe6c539f_amd64 as a component of Red Hat OpenShift GitOps 1.2redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0580
Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:d9db3e25b20c2a28ba1a26ce466b1d7f0bb7b34e354c75029ef7a6ee21b3b580_amd64 as a component of Red Hat OpenShift GitOps 1.2redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0580
Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:4b315cd3607577f9187f97c9df7a65a5dc94982d6166bf0d2fc7cf8c1ef7246c_amd64 as a component of Red Hat OpenShift GitOps 1.2redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0580
Fixedopenshift-gitops-1/gitops-rhel8@sha256:8199d51003b6fb3e180785a905c0f757497567bdba3ec2427812aad6f803942d_amd64 as a component of Red Hat OpenShift GitOps 1.2redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0580
Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:e977766c14c86eb12734b908afa3286b5a66297bd11ffa4f2f5500e5051b9c17_amd64 as a component of Red Hat OpenShift GitOps 1.2redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0580
Fixedopenshift-gitops-1/applicationset-rhel8@sha256:0b363d4585532f8673fc607e757b40b8e78a794539a60e7766efbe29e6d884d1_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0682
Fixedopenshift-gitops-1/argocd-rhel8@sha256:435439882f34fc487ff8c2606145c931a7480869290b7c5cdc3ca101b8354a96_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0682
Fixedopenshift-gitops-1/dex-rhel8@sha256:23359cdf86879be49e4ad727a7e32e0457b3e2618ea6d72b5515098812772158_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0682
Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:1d18cfdb839ff44dff1e2fdc9da4008c91ce25758328f200b9e282bfd8c7c08e_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0682
Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:d7c95e762e992b14104c482cfa1b2e017d8d1cfb45e507e9840cad211ddd5068_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0682
Fixedopenshift-gitops-1/gitops-rhel8@sha256:252b2925e966b60180643884b910b09111104c03facc1264ef7ea692efce70d7_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0682
Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:72fb789851fd76c39d4387affffdddcc4897fd904edebcc169aad65ccc304fb1_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2022:0682

cvss

Technical severity, 0–10. One row per scoring source.

7.7

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4–7.7

v2.04mediumAV:N/AC:L/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8 · impact 2.9

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.1 · impact 4

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · OSV

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:Psecondary · CVSS-BT (t0sche)

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USprimaryCWE-200USCWE-22USCWE-22US

exploits (1)

Public proof-of-concept and weaponised exploit code.

DeveloperOl/CVE-2022-24348-2Find similar issues like CVE-2022-24348PoC · poc_in_github

affected products (34)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
argoproj argo cd< 2.1.9nvdUScpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
argoproj argo cd2.2.0 → 2.2.4nvdUScpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
Go github.com/argoproj/argo-cdall versionsosvUSpkg:golang/github.com/argoproj/argo-cd
Go github.com/argoproj/argo-cd< 2.1.9osvUSpkg:golang/github.com/argoproj/argo-cd
Go github.com/argoproj/argo-cd/v2< 2.1.9osvUSpkg:golang/github.com/argoproj/argo-cd/v2
Go github.com/argoproj/argo-cd/v22.2.0 → 2.2.4osvUSpkg:golang/github.com/argoproj/argo-cd/v2
openshift-gitops-1/applicationset-rhel8@sha256:0b363d4585532f8673fc607e757b40b8e78a794539a60e7766efbe29e6d884d1_amd64 as a component of Red Hat OpenShift GitOps 1.3all versionsfixedredhat_csafUS
openshift-gitops-1/applicationset-rhel8@sha256:7027540d0244496785cd368a3802d551f974f5114735966dc4b5846ab70832cb_amd64 as a component of Red Hat OpenShift GitOps 1.3all versionsfixedredhat_csafUS
openshift-gitops-1/applicationset-rhel8@sha256:8b317cf28ec94757e661e83075ab9ac8397c4940197366ee5e0091d9423f7cc6_amd64 as a component of Red Hat OpenShift GitOps 1.4all versionsfixedredhat_csafUS
openshift-gitops-1/applicationset-rhel8@sha256:de60b8e0019f8cd5900ab934761c289973b8e80f74c7f343e9b8c7bdab35ec7b_amd64 as a component of Red Hat OpenShift GitOps 1.2all versionsfixedredhat_csafUS
openshift-gitops-1/argocd-rhel8@sha256:435439882f34fc487ff8c2606145c931a7480869290b7c5cdc3ca101b8354a96_amd64 as a component of Red Hat OpenShift GitOps 1.3all versionsfixedredhat_csafUS
openshift-gitops-1/argocd-rhel8@sha256:6ebac7a8e959032d7634d2992e18efdc12668dff7a50cd94d080eb11d08b9c30_amd64 as a component of Red Hat OpenShift GitOps 1.4all versionsfixedredhat_csafUS
openshift-gitops-1/argocd-rhel8@sha256:ba9c8eb1b6ab9633a67f82038a8d597f070e9d1d3bee50bb3944b5ccbe6c539f_amd64 as a component of Red Hat OpenShift GitOps 1.2all versionsfixedredhat_csafUS
openshift-gitops-1/argocd-rhel8@sha256:bc5e750413e3806b92a548029010f82aee0bede3b0fe918fd53c280e2384359b_amd64 as a component of Red Hat OpenShift GitOps 1.3all versionsfixedredhat_csafUS
openshift-gitops-1/dex-rhel8@sha256:20a85d451ff3697f5d7c3f55d4776832cdf7a6a90623ce72d481dd6becad3b97_amd64 as a component of Red Hat OpenShift GitOps 1.3all versionsfixedredhat_csafUS
openshift-gitops-1/dex-rhel8@sha256:23359cdf86879be49e4ad727a7e32e0457b3e2618ea6d72b5515098812772158_amd64 as a component of Red Hat OpenShift GitOps 1.3all versionsfixedredhat_csafUS
openshift-gitops-1/dex-rhel8@sha256:3a3635a1d9782966131d131ab0296c86e7b9f501d2940bab6e7cbcae4255d221_amd64 as a component of Red Hat OpenShift GitOps 1.4all versionsfixedredhat_csafUS
openshift-gitops-1/gitops-operator-bundle@sha256:1d18cfdb839ff44dff1e2fdc9da4008c91ce25758328f200b9e282bfd8c7c08e_amd64 as a component of Red Hat OpenShift GitOps 1.3all versionsfixedredhat_csafUS
openshift-gitops-1/gitops-operator-bundle@sha256:636a040e83d025996d133fc6f90a625aed2d8bb81db45c23bb8e11d6d5571993_amd64 as a component of Red Hat OpenShift GitOps 1.3all versionsfixedredhat_csafUS

showing 20 of 34

advisories (6)

Vendor and ecosystem advisories describing this.

RHSA-2022:0476Red Hat Security Advisory: Red Hat OpenShift GitOps security update2022-02-08csaf · redhat_csafUS
An update is now available for Red Hat OpenShift GitOps 1.3 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2022:0477Red Hat Security Advisory: Red Hat OpenShift GitOps security update2022-02-08csaf · redhat_csafUS
An update is now available for Red Hat OpenShift GitOps 1.4 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2022:0580Red Hat Security Advisory: Red Hat OpenShift GitOps security update2022-02-17csaf · redhat_csafUS
An update for openshift-gitops-applicationset-container, openshift-gitops-container, openshift-gitops-kam-delivery-container, and openshift-gitops-operator-container is now available for Red Hat OpenShift GitOps 1.2. (GitOps v1.2.2) Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2022:0682Red Hat Security Advisory: Red Hat OpenShift GitOps security update2022-02-25csaf · redhat_csafUS
An update for openshift-gitops-applicationset-container, openshift-gitops-container, openshift-gitops-kam-delivery-container, and openshift-gitops-operator-container is now available for Red Hat OpenShift GitOps 1.3 on OCP 4.7-4.9. (GitOps v1.3.4) Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
GHSA-63qx-x74g-jcr7Path traversal and dereference of symlinks in Argo CD2022-02-07ghsa · osvUS
### Impact All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts. Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files outside the repository's root directory. If an attacker with permissions to create or update Applications knows or can guess the full path to a file containing valid YAML, they can create a malicious Helm chart to consume that YAML as values files, thereby gaining access to data they would otherwise have no access to. The impact can especially become critical in environments that make use of encrypted value files (e.g. using plugins with git-crypt or SOPS) containing sensitive or confidential data, and decrypt these secrets to disk before rendering the Helm chart. Also, because any error message from `helm template` is passed back to the user, and these error messages are quite verbose, enumeration of files on the repository server's file system is possible. ### Patches A patch for this vulnerability has been released in the following Argo CD versions: * v2.3.0 * v2.2.4 * v2.1.9 We urge users of Argo CD to update their installation to one of the fixed versions as listed above. ### Workarounds No workaround for this issue. ### References * https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24348 ### For more information * Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions) * Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel `#argo-cd` ### Credits The path traversal vulnerability was discovered and reported by Moshe Zioni, VP Security Research, [Apiiro](https://www.apiiro.com). During the development of a fix for the path traversal vulnerability, the Argo CD team discovered the related issue with symbolic links. The Argo CD team would like to thank Moshe Zioni for the responsible disclosure, and the constructive discussions during handling this issue!
GO-2022-0304Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd2024-08-21vendor · osvUS
Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd redhat_csaf NVD CVE.org MITRE

published 2022-02-04modified 2026-06-17

related (12,528)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-104286US	—OT critical	4.57% (92nd)	KEV	2026-10-01
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail…
CVE-2026-93616US	—OT critical	91.6% (100th)	KEV	2026-09-22
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
CVE-2026-85706US	—OT critical	97.4% (100th)	KEV	2026-09-12
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2…
CVE-2026-66384US	—OT critical	0.66% (52nd)	KEV	2026-08-12
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
CVE-2026-59310US	—OT critical	2.56% (85th)	KEV	2026-07-30
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

+12523 more

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan