Executive Summary

This vulnerability exists in the unarchive internal module's archive extraction commands, which do not perform code-level validation on the paths of extracted files. Instead, they rely entirely on the behavior of external tools like GNU tar, which can vary depending on the platform.

While a previous vulnerability (CVE-2025-10284) addressed remote code execution (RCE) vectors specific to git, the fundamental issue of archive extraction path traversal was never fixed.

On systems using GNU tar versions earlier than 1.34 (such as Ubuntu 20.04, Debian Buster, CentOS 7, and many Docker base images), a maliciously crafted archive can exploit this flaw to write files outside the intended extraction directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform path traversal during archive extraction, enabling them to write files outside the intended directory.

Such unauthorized file writes can lead to integrity issues, potentially overwriting critical system or application files.

Although the CVSS score indicates no confidentiality impact, the integrity impact is high, meaning attackers could modify or replace files, which might lead to further exploitation or system instability.

Useful 0 Not Useful 0