Introduction
Attackers can overwrite critical files like /etc/passwd or /etc/crontab inside Kubernetes workflow containers by exploiting a flaw in Argo Workflows' artifact extraction. The flaw affects organizations that run data pipelines, CI/CD, or ML workflows on Kubernetes clusters with an affected version of Argo Workflows.
Argo Workflows is an open-source workflow engine for Kubernetes, maintained by the Argo project under the CNCF. Hundreds of organizations use it to orchestrate parallel jobs, data pipelines, and CI/CD workflows in cloud and on-premises environments. Because it is popular and integrates with major cloud providers, a vulnerability in Argo Workflows can have a wide impact across the tech industry.
Technical Information
CVE-2025-62156 is a Zip Slip path traversal vulnerability in the artifact extraction logic of Argo Workflows. It sits in the workflow executor component, in the unpack/untar logic in workflow/executor/executor.go. When the executor extracts an artifact (a ZIP or TAR file), it builds the destination path for each archive entry with:
filepath.Join(dest, filepath.Clean(header.Name))
dest is the intended extraction directory (typically /work/tmp), and header.Name is the file path from the archive entry. filepath.Clean normalizes the path, but it does not check that the result stays inside the extraction directory. An entry with a path like ../../../../etc/passwd, or an absolute path like /etc/crontab, can still escape that directory after cleaning.
An attacker can therefore craft an archive whose entries, once extracted, overwrite files outside /work/tmp, including sensitive system files in the container. Overwriting /etc/passwd can enable privilege escalation by adding or modifying user accounts. Changing /etc/crontab or /etc/hosts can give the attacker persistence or disrupt container operations. Both ZIP and TAR artifact extraction are affected.
The root cause is missing validation after the archive entry path is cleaned. Nothing checks that the final extraction path is still a child of the intended extraction directory, and that gap is what makes directory traversal possible.
Affected Systems and Versions
- Product: Argo Workflows (open-source workflow engine for Kubernetes)
- Affected versions:
- All versions prior to 3.6.12
- Versions 3.7.0 through 3.7.2
- Fixed in:
- 3.6.12
- 3.7.3
Any deployment that runs an affected version and allows artifact extraction from untrusted sources is vulnerable.
Vendor Security History
Argo Workflows has previously fixed vulnerabilities in artifact handling, authentication, and privilege escalation. The project runs a public security advisory process and works with the CNCF and HackerOne on responsible disclosure. Past advisories covered workflow archive access, resource exhaustion in daemon workflows, and privilege escalation through artifact handling. The project typically ships patches promptly, with clear upgrade guidance.
