Every CVE Search/ Get API key

CVE-2024-57966

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

5.0 MediumFix available

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.28%Up 0.2 points since Feb 3, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.0

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

Record
CVE-2024-57966
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Weakness
CWE-36
Updated
2026-11-02
EUVDEUVD-2024-53866 5.0

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

Record
EUVD-2024-53866
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-v9cx-qp5g-qchc 5.0

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

Record
GHSA-v9cx-qp5g-qchc
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Weakness
CWE-36
Updated
2026-11-02
NVD 5.0

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

Record
CVE-2024-57966
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Weakness
CWE-36
Updated
2026-11-02
OSV 5.0

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

Record
CVE-2024-57966
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Weakness
CWE-36
Updated
2026-11-02
OSVDEBIAN-CVE-2024-57966 5.0

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

Record
DEBIAN-CVE-2024-57966
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2025-1130 5.0

ark security update

Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha (if appropriate command-line programs are installed).

Security Fix(es):

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.(CVE-2024-57966)

Record
OESA-2025-1130
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2025-1131 5.0

ark security update

Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha (if appropriate command-line programs are installed).

Security Fix(es):

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.(CVE-2024-57966)

Record
OESA-2025-1131
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2025-1132 5.0

ark security update

Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha (if appropriate command-line programs are installed).

Security Fix(es):

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.(CVE-2024-57966)

Record
OESA-2025-1132
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2025-1133 5.0

ark security update

Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha (if appropriate command-line programs are installed).

Security Fix(es):

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.(CVE-2024-57966)

Record
OESA-2025-1133
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2024-57966 5.0

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.

Record
UBUNTU-CVE-2024-57966
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Updated
2026-11-02
OSVMGASA-2025-0061 No score

Updated ark packages fix security vulnerability

A security issue exists in Ark where a maliciously crafted archive containing file paths beginning with "/" allows files to be extracted to locations outside the intended directory.

Record
MGASA-2025-0061
Updated
2026-11-02
OSVopenSUSE-SU-2025:0090-1 No score

Security update for ark

This update for ark fixes the following issues:

  • CVE-2024-57966: Disable extraction to absolute path from an archive (boo#1236737)
Record
openSUSE-SU-2025:0090-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ark
Debian:12
 before 4:22.12.3-1+deb12u1, plus listed versions
4:22.12.3-1
4:22.12.3-1+deb12u1
ark
Debian:13
 before 4:24.12.0-1
4:24.12.0-1
ark
Debian:14
 before 4:24.12.0-1
4:24.12.0-1
ark
Debian:11
 before 4:20.12.2-1+deb11u1, plus listed versions
4:20.12.2-1
4:20.12.2-1+deb11u1
ark
Mageia:9
 before 23.04.3-1.1.mga9
23.04.3-1.1.mga9
ark
openEuler:24.03-LTS-SP1
 before 23.08.4-3.oe2403sp1
23.08.4-3.oe2403sp1
ark
openEuler:22.03-LTS-SP3
 before 22.08.3-2.oe2203sp3
22.08.3-2.oe2203sp3
ark
openEuler:22.03-LTS-SP4
 before 22.08.3-2.oe2203sp4
22.08.3-2.oe2203sp4
ark
openEuler:24.03-LTS
 before 23.08.4-3.oe2403
23.08.4-3.oe2403
ark
Ubuntu:16.04:LTS
 All versions, plus listed versions
4:15.08.2-0ubuntu14:15.12.1-0ubuntu14:15.12.3-0ubuntu14:15.12.3-0ubuntu1.14:15.12.3-0ubuntu1.2
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
ark
Ubuntu:18.04:LTS
 All versions, plus listed versions
4:17.04.3-0ubuntu34:17.08.3-0ubuntu14:17.08.3-0ubuntu24:17.12.2-0ubuntu14:17.12.3-0ubuntu14:17.12.3-0ubuntu1.14:17.12.3-0ubuntu1.2
 None known
ark
Ubuntu:20.04:LTS
 All versions, plus listed versions
4:19.04.3-0ubuntu24:19.08.1-14:19.08.3-0ubuntu14:19.12.0-0ubuntu14:19.12.0-1
Show 5 moreShow less
4:19.12.1-0ubuntu14:19.12.2-0ubuntu14:19.12.3-0ubuntu14:19.12.3-0ubuntu1.14:19.12.3-0ubuntu1.2
 None known
ark
Ubuntu:22.04:LTS
 All versions, plus listed versions
4:21.08.1-0ubuntu24:21.08.2-14:21.08.3-14:21.11.80-0ubuntu14:21.11.90-0ubuntu1
Show 6 moreShow less
4:21.11.90-0ubuntu24:21.12.0-0ubuntu14:21.12.1-0ubuntu14:21.12.2-0ubuntu14:21.12.3-0ubuntu14:21.12.3-1ubuntu1
 None known
ark
Ubuntu:24.04:LTS
 All versions, plus listed versions
4:23.08.1-0ubuntu14:23.08.2-0ubuntu14:23.08.3-0ubuntu14:23.08.4-0ubuntu14:23.08.5-0ubuntu14:23.08.5-0ubuntu34:23.08.5-0ubuntu44:23.08.5-0ubuntu5
 None known
ark
SUSE:Package Hub 15 SP6
 before 23.08.5-bp156.2.3.1
23.08.5-bp156.2.3.1
ark
openSUSE:Leap 15.6
 before 23.08.5-bp156.2.3.1
23.08.5-bp156.2.3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-57966 is a medium vulnerability (CVSS 5.0) in Kde Ark, published February 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in ark 4:22.12.3-1+deb12u1.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open