CVE-2024-0406
Mholt/archiver: path traversal vulnerability
MEDIUM 6.1
At a glance
- Source
- NVD
- EPSS
- EPSS 0.93 % · percentile 60 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Analyzed
Description
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
Weaknesses (CWE)
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N | redhat |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-rhh4-rh7c-7r5v — Archiver Path Traversal vulnerability
- GO-2024-2698 — Archiver Path Traversal vulnerability in github.com/mholt/archiver
European references
- ENISA EUVD · EUVD-2024-1299
- GCVE · GCVE-0-2024-0406
CERT-FR advisories
- CERTFR-2025-AVI-0760 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0622 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0003 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:mholt:archiver:*:*:*:*:*:*:*:*≥ 3.0.0 < 4.0.0cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*≥ 4.18 < 4.18.4
Affected products
| Product | Versions |
|---|---|
| archiver | affected v3.0.0 < * ; unaffected v4.0.0 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202503051333.p0.g22b273d.assembly.stream.el9 < * |
| Red Hat · Red Hat Advanced Cluster Security 3 | |
| Red Hat · Red Hat Advanced Cluster Security 3 | |
| Red Hat · Red Hat Advanced Cluster Security 3 | |
| Red Hat · Red Hat Advanced Cluster Security 4 | |
| Red Hat · Red Hat Advanced Cluster Security 4 | |
| Red Hat · Red Hat Advanced Cluster Security 4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |