GHSA-q3rp-vvm7-j8jg: Safearchive Path Traversal vulnerability

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-10389

Safearchive Path Traversal vulnerability

Moderate severity GitHub Reviewed Published Nov 4, 2024 to the GitHub Advisory Database • Updated Nov 4, 2024

Package

gomod github.com/google/safearchive (Go)

Affected versions

< 0.0.0-20241025131057-f7ce9d7b6f9c

Patched versions

0.0.0-20241025131057-f7ce9d7b6f9c

There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-10389
• google/safearchive@f7ce9d7

Published to the GitHub Advisory Database

Nov 4, 2024