CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2024-0406
High (7.8). EPSS 0.9% chance of exploitation in the next 30 days.
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mholt:archiver
- redhat:advanced_cluster_security
- redhat:openshift_container_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rhh4-rh7c-7r5v | Go | github.com/mholt/archiver/v3 | >=3.0.0 <=3.5.1 | no fix published |
| GHSA-rhh4-rh7c-7r5v | Go | github.com/mholt/archiver | >=3.0.0 <=3.5.1 | no fix published |
| GO-2024-2698 | Go | github.com/mholt/archiver | all versions | no fix published |
| GO-2024-2698 | Go | github.com/mholt/archiver/v3 | all versions | no fix published |