Path Traversal Vulnerability in mholt/archiver by Go

CVE-2025-3445

Summary

A Path Traversal vulnerability in mholt/archiver allows attackers to exploit crafted ZIP files with symlinks. By utilizing the archiver.Unarchive functionality, an attacker can overwrite files on the system, potentially leading to sensitive data exposure, privilege escalation, and unauthorized code execution. The issue arises when ZIP files are extracted, enabling attackers to manipulate filesystem paths, compromising application integrity. Users are advised to transition to the newer mholt/archives, which eliminates the vulnerable functionality.

References