CVE-2025-64346: archives: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Severity: medium (CVSS 6.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-07 · updated 2026-06-17
Weakness: CWE-22

Description

archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the program that imports it. Severity depends on user permissions, environment and how arbitrary archives are passed. This issue is fixed in version 1.0.1.

Affected products

jaredallard archives: before 1.0.1

References

https://github.com/jaredallard/archives/commit/3bddec7bd3f38afbe97ae61d1c8a8487e9ea4ef1
https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h

Get alerted when CVE-2025-64346 or the next vulnerability affects your stack