Vulnerability · Published Nov 7, 2025 · Assigned by GitHub_M
CVE-2025-64346archives: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Medium 6.0
In plain English
A medium-severity path traversal in archives from jaredallard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the program that imports it. Severity depends on user permissions, environment and how arbitrary archives are passed. This issue is fixed in version 1.0.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/jaredallard/archives | 1.0.1 | GHSA-j95m-rcjp-q69h |
| Go | github.com/jaredallard/archives | 1.0.1 | GO-2025-3581 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jaredallard | archives | < 1.0.1 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N