cve.bz

CVE-2024-10389

5.9 mediumEPSS 0.2%

Medium (5.9) in google safearchive. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/google/safearchive 0.0.0-20241025131057-f7ce9d7b6f9c.

There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc

Severity

CVSS 4.0

5.9 medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/AU:Y/R:U/V:D/RE:L/U:Green

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
CWEs
CWE-22, CWE-427
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-q3rp-vvm7-j8jgGogithub.com/google/safearchive<0.0.0-20241025131057-f7ce9d7b6f9c0.0.0-20241025131057-f7ce9d7b6f9c
GO-2024-3251Gogithub.com/google/safearchive<0.0.0-20241025131057-f7ce9d7b6f9c0.0.0-20241025131057-f7ce9d7b6f9c

References

Check your stackJSON