CVE-2022-25856

The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ...

• CWE-22
• CWE-59

• https://github.com/argoproj/argo-events/commit/d0f66dbce78bc31923ca057b20fc722aa24ca961Patch, Third Party Advisory
• https://github.com/argoproj/argo-events/issues/1947Exploit, Issue Tracking, Third Party Advisory
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522Exploit, Patch, Third Party Advisory
• https://github.com/argoproj/argo-events/commit/d0f66dbce78bc31923ca057b20fc722aa24ca961Patch, Third Party Advisory
• https://github.com/argoproj/argo-events/issues/1947Exploit, Issue Tracking, Third Party Advisory
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522Exploit, Patch, Third Party Advisory

Published

Jun 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25850The package github.com/hoppscotch/proxyscotch before 1.0.0 a…7.5
• CVE-2022-25851The package jpeg-js before 0.4.4 are vulnerable to Denial of…7.5
• CVE-2022-25852All versions of package pg-native; all versions of package l…7.5
• CVE-2022-25853All versions of the package semver-tags are vulnerable to Co…7.8
• CVE-2022-25854This affects the package @yaireo/tagify before 4.9.8. The pa…5.4
• CVE-2022-25855All versions of the package create-choo-app3 are vulnerable …7.8
• CVE-2022-25857The package org.yaml:snakeyaml from 0 and before 1.31 are vu…7.5
• CVE-2022-25858The package terser before 4.8.1, from 5.0.0 and before 5.14.…7.5
• CVE-2022-2586It was discovered that a nft object or expression could refe…7.8
• CVE-2022-25860Versions of the package simple-git before 3.16.0 are vulnera…9.8
• CVE-2022-25862This affects the package sds from 0.0.0. The library could b…7.5
• CVE-2022-25863The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and …9.8