Safearchive Path Traversal vulnerability

HIGH 7.5CVE-2024-10389 · GHSA-q3rp-vvm7-j8jg · GO-2024-3251 · Published 04/11/2024 · updated 17/06/2026

In short

CVE-2024-10389 is a HIGH (CVSS 7.5) vulnerability affecting github.com/google/safearchive, safearchive (google).
Chance of exploitation in the next 30 days (EPSS): 0.19%, higher than 9.0% of all vulnerabilities.
Fix: update to 0.0.0-20241025131057-f7ce9d7b6f9c, 2024-10-25 or later.

Package	Affected versions	Patched versions
github.com/google/safearchive Go	`< 0.0.0-20241025131057-f7ce9d7b6f9c`	`0.0.0-20241025131057-f7ce9d7b6f9c`
safearchive google	`< 2024-10-25`	`2024-10-25`

Description

There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-10389 · ADVISORY
google/safearchive commit f7ce9d7 · WEB
GitHub Advisory GHSA-q3rp-vvm7-j8jg · ADVISORY
google/safearchive · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free