The vulnerability arises from a path traversal flaw (CWE-22) in the repo-server’s handling of .jsonnet import, importstr, and importbin functions, which are not confined to the repository root. This omission permits attackers to read any file accessible to the repo-server, including environment variables, service-account tokens, and private keys, and to return their contents as data. Because imported data can be placed into a ConfigMap, the contents are returned to the caller, enabling the disclosure of sensitive information. Attempting to import a non-terminating device such as /dev/zero can also exhaust server memory, leading to a denial-of-service attack.

Argo CD versions from 0.9.0 up to 3.3.15, 3.4.10, 3.5.4, and the release candidate 3.6.0-rc2 are vulnerable. The affected component is the repo-server, which evaluates .jsonnet files for any Application that uses a Git repository or that uploads a file via the POST /api/v1/applications/manifestsWithFiles endpoint. The vulnerability is present for any user who has Application get permission on an existing directory Application; no Application update, sync, or repository write permission is required.

With a CVSS score of 9.9 the vulnerability is considered Critical. The EPSS score is not publicly available, and the issue is not listed in the CISA KEV catalog, but the lack of path confinement makes exploitation straightforward for anyone who can commit or upload a .jsonnet file. Because the import functions can be triggered by normal application deployment workflows, an attacker only needs to supply a malicious file, making this a high-risk vector that can disclose secrets and crash the repo-server. The vulnerability can also be leveraged through the argocd app diff --local --server-side-generate feature, which exposes the same import logic.