PT-2025-45412 · Archive · Archive

Published 2025-03-28 · Updated 2025-11-07 · CVE-2025-64346

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions archives version 1.0.0

Description archives is a Go library used for extracting archives such as tar and zip files. Version 1.0.0 does not adequately prevent a malicious user from providing a specially crafted archive that could lead to Remote Code Execution (RCE), file modification, or other harmful actions. The severity of the issue depends on the user's permissions, the environment, and how arbitrary archives are handled. The issue arises from improper limitation of a pathname to a restricted directory, allowing for potential path traversal.

Recommendations Update to version 1.0.1 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-64346

GHSA-J95M-RCJP-Q69H

GO-2025-3581

Affected Products

Archive

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64346.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-64346 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j95m-rcjp-q69h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64346 · Security Note
• https://osv.dev/vulnerability/GO-2025-3581 · Vendor Advisory
• https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h · Note
• https://github.com/jaredallard/archives/commit/3bddec7bd3f38afbe97ae61d1c8a8487e9ea4ef1 · Note
• https://t.me/CVEtracker/36752 · Telegram Post
• https://github.com/jaredallard/archives · Note
• https://twitter.com/CVEnew/status/1986694154882363796 · Twitter Post
• https://t.me/cveNotify/142064 · Telegram Post