Cyber Posture

CVE-2025-62156

HighPublic PoC

Published: 14 October 2025

Published
14 October 2025
Modified
06 February 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0015 35.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.

Security Summary

CVE-2025-62156 is a Zip Slip path traversal vulnerability in Argo Workflows, an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The issue affects versions prior to 3.6.12 and versions 3.7.0 through 3.7.2, specifically in the artifact extraction logic within workflow/executor/executor.go. This logic uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that the cleaned header.Name remains within the intended /work/tmp extraction directory, allowing malicious archive entries with traversal sequences or absolute paths to write files outside the target path.

An attacker with low privileges (PR:L) can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), achieving high integrity (I:H) and availability (A:H) impacts with unchanged scope (S:U), as scored at CVSS 3.1 8.1. By supplying a malicious archive in a workflow artifact, the attacker can overwrite or create files in sensitive system directories inside the affected container, such as /etc/passwd, /etc/hosts, or /etc/crontab, potentially enabling privilege escalation or persistence within the container (CWE-22).

The Argo Workflows security advisory (GHSA-p84v-gxvw-73pf) and related commits recommend updating to version 3.6.12 or 3.7.3 for remediation. These patches address the validation flaw, as shown in the fixing commits and the original vulnerable code at executor.go line 993.

Details

CWE(s)
CWE-22

Affected Products

argoproj
argo workflows
≤ 3.6.12 · 3.7.0 — 3.7.3

MITRE ATT&CK Enterprise Techniques

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1136.001 Local Account Persistence
Adversaries may create a local account to maintain access to victim systems.
attack.mitre.org →
T1053.003 Cron Execution
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.
attack.mitre.org →
Why these techniques?

Zip Slip path traversal enables arbitrary file writes inside the container (e.g., /etc/passwd for local account creation T1136.001, /etc/crontab for cron persistence T1053.003), facilitating privilege escalation (T1068) via exploitation of the remote workflow service (T1210).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References