CVE-2025-3445: Path Traversal
First published: Sun Apr 13 2025(Updated: )
A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the archiver.Unarchive functionality with ZIP files, like this: archiver.Unarchive(zipFile, outputDir), A crafted ZIP file can be extracted in such a way that it writes files to the affected system with the same privileges as the application executing this vulnerable functionality. Consequently, sensitive files may be overwritten, potentially leading to privilege escalation, code execution, and other severe outcomes in some cases. It's worth noting that a similar vulnerability was found in TAR files (CVE-2024-0406). Although a fix was implemented, it hasn't been officially released, and the affected project has since been deprecated. The successor to mholt/archiver is a new project called mholt/archives, and its initial release (v0.1.0) removes the Unarchive() functionality.
Credit: reefs@jfrog.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/mholt/archiver/v3 | <=3.5.1 | |
| go/github.com/mholt/archiver | <=3.5.1 | |
| Mholt Archiver | = |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3445?
CVE-2025-3445 is considered a high-severity vulnerability due to its potential for file overwriting with user privileges.
How do I fix CVE-2025-3445?
To fix CVE-2025-3445, update to a version of mholt/archiver that addresses the path traversal vulnerability.
What systems are impacted by CVE-2025-3445?
CVE-2025-3445 impacts any system using the mholt/archiver library in Go that processes ZIP files.
What type of vulnerability is CVE-2025-3445?
CVE-2025-3445 is a Path Traversal vulnerability also known as a 'Zip Slip' vulnerability.
Can CVE-2025-3445 lead to remote code execution?
While CVE-2025-3445 primarily allows file overwriting, it can lead to potential remote code execution if the overwritten files are subsequently executed.
- agent/first-publish-date
- agent/type
- agent/weakness
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/severity
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7vpp-9cxj-q8gv
- alias/CVE-2025-3445
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-cve
- collector/github-advisory
- vendor/mholt
- canonical/mholt archiver
- package-manager/go