Argo Workflows 需授权 路径遍历漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-62156
• https://cve.imfht.com/detail/CVE-2025-62156
• https://zeropath.com/blog/cve-2025-62156-argo-workflows-zip-slip-summary
• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-p84v-gxvw-73pf
• https://avd.aliyun.com/detail?id=AVD-2025-66626
• https://github.com/argoproj/argo-workflows/issues/3016
• https://nvd.nist.gov/vuln/detail/CVE-2025-66626
• https://www.endorlabs.com/learn/when-a-broken-fix-leads-to-rce-how-we-found-cve-2025-66626-in-argo

Related Vulnerabilities

• PoCCVE-2026-10768: Drupal LocalGov Workflows < 1.6.0 - Information Disclosure
• PoCargo-workflows-unauth: Argo Workflows - Unauthenticated Dashboard
• PoC九思OA /jsoa/workflow/dwr/exec/workflowSync.getUserStatusByRole.dwr SQL 注入漏洞
• 用友NC系统workflowService接口SQL注入漏洞
• PoCoa8000-workflowservice-sql-inject: 华天动力OA 8000版 workFlowService SQL注入漏洞
• PoCgithub-workflows-disclosure: Github Workflow Disclosure
• PoChuatian-oa8000-sqli: Huatian Power OA 8000 workFlowService - SQL injection
• 用友 NC /portal/pt/servlet/workflowService/doPost SQL 注入漏洞
• 九思协同办公系统 /jsoa/workflow/dwr/exec/workflowSync.getUserStatusByRole.dwr 存在SQL注入漏洞
• 泛微OA E-cology WorkflowServiceXml getUserId SQL注入漏洞
• 泛微e-cology WorkflowServiceXml SQL注入漏洞