Github · Actions/Artifact · CVE-2024-42471
**Name of the Vulnerable Software and Affected Versions**
actions/artifact versions 2.0.0 through 2.1.1
actions/artifact versions 2.1.2 through 2.1.6
**Description**
The issue concerns arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to a newer version to mitigate the risk.
**Recommendations**
For actions/artifact versions 2.0.0 through 2.1.1, upgrade to version 2.1.2 or higher.
For actions/artifact versions 2.1.2 through 2.1.6, upgrade to version 2.1.7 or higher.
As a temporary workaround, consider disabling the `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` functions until a patch is available.
Restrict access to the vulnerable `actions/artifact` module to minimize the risk of exploitation.