github - ghsa-wx3r-v6h7-frjp

GHSA-WX3R-V6H7-FRJP

Vulnerability from github – Published: 2025-09-05 21:00 – Updated: 2025-11-03 21:34

Summary

internetarchive Vulnerable to Directory Traversal in File.download()

Details

Impact

What kind of vulnerability is it? This is a Critical severity directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library.

Who is impacted? All users of the internetarchive library versions < 5.5.1 are impacted. The vulnerability is particularly critical for users on Windows systems, but all operating systems are affected.

Description of the vulnerability: The vulnerability existed because the file.download() method did not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., ../../../../windows/system32/file.txt) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory.

Potential Impact: An attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used.

Patches

Has the problem been patched? Yes, the problem has been patched.

What versions should users upgrade to? Users must upgrade to version 5.5.1 or later.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading? There is no direct workaround that does not involve upgrading the library. The vulnerability is in the core logic of the file download process.

The only alternative for users who absolutely cannot upgrade is to implement their own custom download function that:

Manually sanitizes all filenames using a robust method.
Validates that the resolved absolute path of the download target is within the intended directory before writing any files.

However, this essentially re-implements the fix and is not recommended. Upgrading to the patched version is the only safe and supported solution.

References

Release Notes for v5.5.1
Commit with the fix
CVE Identifier: CVE-2025-58438

Severity ?

9.4 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.5.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "internetarchive"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-58438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-05T21:00:42Z",
    "nvd_published_at": "2025-09-06T19:15:38Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n**What kind of vulnerability is it?**\nThis is a **Critical** severity directory traversal (path traversal) vulnerability in the `File.download()` method of the `internetarchive` library.\n\n**Who is impacted?**\nAll users of the `internetarchive` library versions `\u003c 5.5.1` are impacted. The vulnerability is particularly critical for users on **Windows systems**, but all operating systems are affected.\n\n**Description of the vulnerability:**\nThe vulnerability existed because the `file.download()` method did not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., `../../../../windows/system32/file.txt`) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory.\n\n**Potential Impact:**\nAn attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used.\n\n### Patches\n**Has the problem been patched?**\nYes, the problem has been patched.\n\n**What versions should users upgrade to?**\nUsers must upgrade to version **5.5.1** or later.\n\n### Workarounds\nIs there a way for users to fix or remediate the vulnerability without upgrading?\nThere is no direct workaround that does not involve upgrading the library. The vulnerability is in the core logic of the file download process.\n\nThe only alternative for users who absolutely cannot upgrade is to implement their own custom download function that:\n\n1. Manually sanitizes all filenames using a robust method.\n2. Validates that the resolved absolute path of the download target is within the intended directory before writing any files.\n\nHowever, this essentially re-implements the fix and is not recommended. Upgrading to the patched version is the only safe and supported solution.\n\n### References\n\n- [Release Notes for v5.5.1](https://github.com/jjjake/internetarchive/releases/tag/v5.5.1)\n- [Commit with the fix](https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2)\n- **CVE Identifier:**  CVE-2025-58438",
  "id": "GHSA-wx3r-v6h7-frjp",
  "modified": "2025-11-03T21:34:26Z",
  "published": "2025-09-05T21:00:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jjjake/internetarchive"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jjjake/internetarchive/releases/tag/v5.5.1"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00030.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "internetarchive Vulnerable to Directory Traversal in File.download()"
}

CVE-2025-58438 (GCVE-0-2025-58438)

Vulnerability from cvelistv5 – Published: 2025-09-06 18:45 – Updated: 2025-11-03 18:13

Title

internetarchive is vulnerable to Directory Traversal through file downloads

Summary

internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library. The file.download() method does not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., ../../../../windows/system32/file.txt) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory. An attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used. The vulnerability is particularly critical for users on Windows systems, but all operating systems are affected. This issue is fixed in version 5.5.1.

Severity ?

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/jjjake/internetarchive/securit…	x_refsource_CONFIRM
	https://github.com/jjjake/internetarchive/commit/…	x_refsource_MISC
	https://github.com/jjjake/internetarchive/release…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	jjjake	internetarchive	Affected: < 5.5.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-58438",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-08T17:57:59.088902Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-08T17:58:19.276Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:13:54.480Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "internetarchive",
          "vendor": "jjjake",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library. The file.download() method does not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., ../../../../windows/system32/file.txt) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory. An attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used.  The vulnerability is particularly critical for users on Windows systems, but all operating systems are affected. This issue is fixed in version 5.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-06T18:45:55.833Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp"
        },
        {
          "name": "https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2"
        },
        {
          "name": "https://github.com/jjjake/internetarchive/releases/tag/v5.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jjjake/internetarchive/releases/tag/v5.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-wx3r-v6h7-frjp",
        "discovery": "UNKNOWN"
      },
      "title": "internetarchive is vulnerable to Directory Traversal through file downloads"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-58438",
    "datePublished": "2025-09-06T18:45:55.833Z",
    "dateReserved": "2025-09-01T20:03:06.532Z",
    "dateUpdated": "2025-11-03T18:13:54.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-WX3R-V6H7-FRJP

Impact

Patches

Workarounds

References

CVE-2025-58438 (GCVE-0-2025-58438)

Tags

Sightings

Nomenclature