Listen to this Post
How the CVE works:
The vulnerability exists in the untar function of Argo Workflows’ executor. The code handling symbolic links during archive extraction is flawed. Specifically, in executor.go lines 1034-1037, the computation of the link target path and subsequent validation are insufficient. When extracting a malicious archive containing a symbolic link with path “./work/foo” targeting “/etc”, and a normal file “./work/foo/hostname”, the extraction process incorrectly follows the link. This causes the hostname file to be written to “/etc/hostname”, bypassing intended security checks. The ineffective patch for CVE-2025-62156 fails to prevent this, allowing attackers to overwrite arbitrary files, such as /var/run/argo/argoexec, leading to remote code execution upon pod start.
Platform: Argo Workflows
Version: Prior versions
Vulnerability: Symbolic link bypass
Severity: Critical
Date: 2025-XX-XX
Prediction: Re-patch 2025-Q4
What Undercode Say:
Analytics:
Vulnerable code snippet
https://github.com/argoproj/argo-workflows/blob/5291e0b01f94ba864f96f795bb500f2cfc5ad799/workflow/executor/executor.goL1034-L1037
Bash commands for PoC
mkdir -p ./work
ln -s /etc ./work/foo
echo “malicious” > ./work/foo/hostname
tar -cvf malicious.tar ./work
How Exploit:
Craft malicious archive. Mount in workflow. Extract to overwrite files.
Protection from this CVE
Apply updated patch. Validate symbolic links. Restrict archive mounts.
Impact:
Arbitrary file overwrite. Remote code execution. Pod compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
