CVE-2025-64346: archives: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the program that imports it. Severity depends on user permissions, environment and how arbitrary archives are passed. This issue is fixed in version 1.0.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64346?
CVE-2025-64346 is classified as a critical vulnerability due to its potential for remote code execution and file modification.
How do I fix CVE-2025-64346?
To fix CVE-2025-64346, upgrade to a patched version of the archives library beyond version 1.0.0.
What types of attacks are possible with CVE-2025-64346?
CVE-2025-64346 allows for attacks such as remote code execution, file modification, and manipulation of the user's application context.
Which software is affected by CVE-2025-64346?
CVE-2025-64346 affects the archives library version 1.0.0 used for extracting various archive formats.
Who is the vendor of the affected software for CVE-2025-64346?
The affected software, archives, does not have a specific vendor associated as it is an open-source Go library.