https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:17:37 +0000 https://db.gcve.eu/vuln/ghsa-p84v-gxvw-73pf <p><strong>Affected:</strong> Go: github.com/argoproj/argo-workflows/v3</p> <p>### **Vulnerability Description**</p> <p>#### Vulnerability Overview</p> <p>1. During the artifact extraction process, the `unpack()` function extracts the compressed file to a temporary directory (`/etc.tmpdir`) and then attempts to move its contents to `/etc` using the `rename()` system call, 2. However, since `/etc` is an already existing system directory, the `rename()` system call fails, making normal archive extraction impossible. 3. At this point, if a malicious user sets the entry name inside the `tar.gz` file to a path traversal like `../../../../../etc/zipslip-poc`, 4. The `untar()` function combines paths using `filepath.Join(dest, filepath.Clean(header.Name))` without path validation, resulting in `target = &#34;/work/input/../../../../../etc/zipslip-poc&#34;`, 5. Ultimately, the `/etc/zipslip-poc` file is created, bypassing the normal archive extraction constraints and enabling direct file writing to system directories.</p> <p>#### untar(): Writing Files Outside the Extraction Directory</p> <p>https://github.com/argoproj/argo-workflows/blob/946a2d6b9ac3309371fe47f49ae94c33ca7d488d/workflow/executor/executor.go#L993</p> <p>1. **Base Path**: `/work/tmp` (dest) — The intended extraction directory in the wait container 2. **Malicious Entry**: `../../../../../../../../../..//mainctrfs/etc/zipslip-ok.txt` (`header.Name`) — Path traversal payload 3. **Path Cleaning**: `filepath.Clean(&#34;../../../../../../../../../..//mainctrfs/etc/zipslip-ok.txt&#34;) = /mainctrfs/etc/zipslip-ok.txt` — Go’s path cleaning nor…</p> <p><strong>Affected:</strong> Go: github.com/argoproj/argo-workflows/v3</p> <p>### **Vulnerability Description**</p> <p>#### Vulnerability Overview</p> <p>1. During the artifact extraction process, the `unpack()` function extracts the compressed file to a temporary directory (`/etc.tmpdir`) and then attempts to move its contents to `/etc` using the `rename()` system call, 2. However, since `/etc` is an already existing system directory, the `rename()` system call fails, making normal archive extraction impossible. 3. At this point, if a malicious user sets the entry name inside the `tar.gz` file to a path traversal like `../../../../../etc/zipslip-poc`, 4. The `untar()` function combines paths using `filepath.Join(dest, filepath.Clean(header.Name))` without path validation, resulting in `target = &#34;/work/input/../../../../../etc/zipslip-poc&#34;`, 5. Ultimately, the `/etc/zipslip-poc` file is created, bypassing the normal archive extraction constraints and enabling direct file writing to system directories.</p> <p>#### untar(): Writing Files Outside the Extraction Directory</p> <p>https://github.com/argoproj/argo-workflows/blob/946a2d6b9ac3309371fe47f49ae94c33ca7d488d/workflow/executor/executor.go#L993</p> <p>1. **Base Path**: `/work/tmp` (dest) — The intended extraction directory in the wait container 2. **Malicious Entry**: `../../../../../../../../../..//mainctrfs/etc/zipslip-ok.txt` (`header.Name`) — Path traversal payload 3. **Path Cleaning**: `filepath.Clean(&#34;../../../../../../../../../..//mainctrfs/etc/zipslip-ok.txt&#34;) = /mainctrfs/etc/zipslip-ok.txt` — Go’s path cleaning nor…</p> https://db.gcve.eu/vuln/ghsa-p84v-gxvw-73pf