What’s Vulnerable › Vulnerabilities

CVE-2024-57966

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-03 · updated 2026-06-17
• Weakness: CWE-36

Description

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

Affected products

• KDE ark: before 24.12.0 — fixed in 24.12.0

How to fix

Upgrade to a fixed version: KDE ark 24.12.0. Check the vendor advisory for mitigations.

References

• https://github.com/KDE/ark/commit/fe518d81b338941e0bf1c5ce5e75a9ab6de4bb58
• https://github.com/KDE/ark/compare/v24.11.90...v24.12.0
• https://lists.debian.org/debian-lts-announce/2025/02/msg00007.html

Get alerted when CVE-2024-57966 or the next vulnerability affects your stack