PT-2024-16238 · Unknown+1 · Safearchive+1

Jan Harrie · Published 2024-11-04 · Updated 2025-07-23 · CVE-2024-10389

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Safearchive versions prior to commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc

Description The issue is related to a Path Traversal vulnerability in Safearchive on platforms with case-insensitive filesystems, such as NTFS. This vulnerability allows attackers to write arbitrary files via archive extraction containing symbolic links.

Recommendations For versions prior to commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc, upgrade past this commit to resolve the issue. As a temporary workaround, consider restricting the use of archive extraction containing symbolic links until a patch is available.

Fix

Uncontrolled Search Path Element

Path traversal

Weakness Enumeration

CWE-427

CWE-22

Related Identifiers

BDU:2025-02256

CVE-2024-10389

GHSA-Q3RP-VVM7-J8JG

GO-2024-3251

OPENSUSE-SU-2024:14470-1

OPENSUSE-SU-2024_4042-1

SUSE-SU-2024:4042-1

Affected Products

Safearchive

Suse

References · 25

• https://github.com/google/safearchive/commit/f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:14470-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10389 · Security Note
• https://osv.dev/vulnerability/GHSA-q3rp-vvm7-j8jg · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4042-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-10389 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02256 · Security Note
• https://github.com/google/safearchive · Note
• https://github.com/advisories/GHSA-q3rp-vvm7-j8jg · Note
• https://suse.com/security/cve/CVE-2024-10975 · Note
• https://suse.com/security/cve/CVE-2024-48057 · Note
• https://suse.com/security/cve/CVE-2024-51744 · Note
• https://t.me/cveNotify/130039 · Telegram Post
• https://t.me/cvedetector/9721 · Telegram Post