VYPR
← All advisories
Moderate severityOSV Advisory· Published Apr 6, 2024· Updated Nov 20, 2025

Mholt/archiver: path traversal vulnerability

CVE-2024-0406

Description

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2024-0406: mholt/archiver tar unpacking allows arbitrary file write via path traversal.

Vulnerability

Overview CVE-2024-0406 is a path traversal vulnerability in the mholt/archiver Go package. The flaw occurs when the library extracts tar archives: it does not properly validate file paths, allowing an attacker to craft a tar archive with entries that escape the intended extraction directory [2][3]. This can lead to arbitrary file creation or overwriting with the privileges of the user or application using the library.

Attack

Vector An attacker must deliver a specially crafted tar file to a user or application that uses the mholt/archiver package to extract archives. No authentication is required for exploitation if the target voluntarily opens the archive. The attack does not require any special network position beyond the ability to provide the malicious archive [1].

Impact

Successful exploitation can result in overwriting critical system files, creating files in restricted directories, or achieving code execution through overwriting executables or configuration files. The impact depends on the privileges of the process using the library [2].

Mitigation

The mholt/archiver package is deprecated and no longer maintained. Users should migrate to the successor package mholt/archives, which has an improved API and security fixes [4]. Red Hat has released an advisory (RHSA-2025:2449) for affected products [1].

References
  1. https://access.redhat.com/errata/RHSA-2025:2449
  2. cve-details
  3. NVD - CVE-2024-0406
  4. GitHub - mholt/archiver: DEPRECATED. Please use mholt/archives instead.

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/mholt/archiver/v3Go
>= 3.0.0, <= 3.5.1—
github.com/mholt/archiverGo
>= 3.0.0, <= 3.5.1—

Affected products

88

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.