Riskcovery

CVE-2024-0406

Mholt/archiver: path traversal vulnerability

State
Published
Severity
6.1 Medium
Published
Apr 6, 2024
Updated
Nov 20, 2025
Reserved
Jan 10, 2024

Read the record on cve.org

Description

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:Nredhat

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
archiver
  • v3.0.0 and laterAffected
  • v4.0.0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat
  • v4.18.0-202503051333.p0.g22b273d.assembly.stream.el9 and laterNot affected
Red Hat Advanced Cluster Security 3Red Hat
    Red Hat Advanced Cluster Security 3Red Hat
      Red Hat Advanced Cluster Security 3Red Hat
        Red Hat Advanced Cluster Security 4Red Hat
          Red Hat Advanced Cluster Security 4Red Hat
            Red Hat Advanced Cluster Security 4Red Hat

              References

              Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.