Every CVE Search/ Get API key

CVE-2024-0406

Mholt/archiver: path traversal vulnerability

6.1 MediumPublic exploitFix available

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
None

Exploit likelihood

0.93%Up 0.9 points since Apr 7, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.1

Mholt/archiver: path traversal vulnerability

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Record
CVE-2024-0406
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2024-1299 6.1

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Record
EUVD-2024-1299
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-rhh4-rh7c-7r5v 6.1

Archiver Path Traversal vulnerability

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Record
GHSA-rhh4-rh7c-7r5v
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 6.1

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Record
CVE-2024-0406
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSV 7.8

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Record
CVE-2024-0406
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-rhh4-rh7c-7r5v 6.1

Archiver Path Traversal vulnerability

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Record
GHSA-rhh4-rh7c-7r5v
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
Show 4 moreShow less
OSVGO-2024-2698 No score

Archiver Path Traversal vulnerability in github.com/mholt/archiver

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Record
GO-2024-2698
Updated
2026-11-02
OSVopenSUSE-SU-2025:14996-1 No score

hauler-1.2.2-1.1 on GA media

These are all security issues fixed in the hauler-1.2.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14996-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15004-1 No score

subfinder-2.7.0-2.1 on GA media

These are all security issues fixed in the subfinder-2.7.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15004-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:20160-1 No score

Security update for hauler

This update for hauler fixes the following issues:

  • Update to version 1.3.1 (bsc#1251516, CVE-2025-47911, bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190, bsc#1248937, CVE-2025-58058):

    • bump github.com/containerd/containerd (#474)
    • another fix to tests for new tests (#472)
    • fixed typo in testdata (#471)
    • fixed/cleaned new tests (#470)
    • trying a new way for hauler testing (#467)
    • update for cosign v3 verify (#469)
    • added digests view to info (#465)
    • bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory (#457)
    • update oras-go to v1.2.7 for security patches (#464)
    • update cosign to v3.0.2+hauler.1 (#463)
    • fixed homebrew directory deprecation (#462)
    • add registry logout command (#460)

  • Update to version 1.3.0:

    • bump the go_modules group across 1 directory with 2 updates (#455)
    • upgraded versions/dependencies/deprecations (#454)
    • allow loading of docker tarballs (#452)
    • bump the go_modules group across 1 directory with 2 updates (#449)

  • update to 1.2.5 (bsc#1246722, CVE-2025-46569):

    • Bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in the go_modules group across 1 directory (CVE-2025-46569)
    • deprecate auth from hauler store copy
    • Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the go_modules group across 1 directory
    • Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group across 1 directory
    • upgraded go and dependencies versions

  • Update to version 1.2.5:

    • upgraded go and dependencies versions (#444)
    • Bump github.com/go-viper/mapstructure/v2 (#442)
    • bump github.com/cloudflare/circl (#441)
    • deprecate auth from hauler store copy (#440)
    • Bump github.com/open-policy-agent/opa (#438)

  • update to 1.2.4 (CVE-2025-22872, bsc#1241804):

    • Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory
    • minor tests updates

  • Update to version 1.2.3:

    • formatting and flag text updates
    • add keyless signature verification (#434)
    • bump helm.sh/helm/v3 in the go_modules group across 1 directory (#430)
    • add --only flag to hauler store copy (for images) (#429)
    • fix tlog verification error/warning output (#428)

  • Update to version 1.2.2 (bsc#1241184, CVE-2024-0406):

    • cleanup new tlog flag typos and add shorthand (#426)
    • default public transparency log verification to false to be airgap friendly but allow override (#425)
    • bump github.com/golang-jwt/jwt/v4 (#423)
    • bump the go_modules group across 1 directory with 2 updates (#422)
    • bump github.com/go-jose/go-jose/v3 (#417)
    • bump github.com/go-jose/go-jose/v4 (#415)
    • clear default manifest name if product flag used with sync (#412)
    • updates for v1.2.0 (#408)
    • fixed remote code (#407)
    • added remote file fetch to load (#406)
    • added remote and multiple file fetch to sync (#405)
    • updated save flag and related logs (#404)
    • updated load flag and related logs [breaking change] (#403)
    • updated sync flag and related logs [breaking change] (#402)
    • upgraded api update to v1/updated dependencies (#400)
    • fixed consts for oci declarations (#398)
    • fix for correctly grabbing platform post cosign 2.4 updates (#393)
    • use cosign v2.4.1+carbide.2 to address containerd annotation in index.json (#390)
    • Bump the go_modules group across 1 directory with 2 updates (#385)
    • replace mholt/archiver with mholt/archives (#384)
    • forked cosign bump to 2.4.1 and use as a library vs embedded binary (#383)
    • cleaned up registry and improved logging (#378)
    • Bump golang.org/x/crypto in the go_modules group across 1 directory (#377)

  • bump net/html dependencies (bsc#1235332, CVE-2024-45338)

  • Update to version 1.1.1:

    • fixed cli desc for store env var (#374)
    • updated versions for go/k8s/helm (#373)
    • updated version flag to internal/flags (#369)
    • renamed incorrectly named consts (#371)
    • added store env var (#370) …
Record
openSUSE-SU-2025:20160-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/mholt/archiver/v3
Go
 3.0.0 to 3.5.1 None known
github.com/mholt/archiver
Go
 3.0.0 to 3.5.1 None known
github.com/mholt/archiver
Go
 All versions None known
github.com/mholt/archiver/v3
Go
 All versions None known
hauler
openSUSE:Tumbleweed
 before 1.2.2-1.1
1.2.2-1.1
subfinder
openSUSE:Tumbleweed
 before 2.7.0-2.1
2.7.0-2.1
hauler
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 1.3.1-bp160.1.1
1.3.1-bp160.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubwalidpyh/CVE-2024-0406-POC2025-03-12
PoC in GitHubveissa/Desires2025-03-29

History

History
RecordedChangedSources
affected, exploits, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-0406 is a medium vulnerability (CVSS 6.1) in Mholt Archiver, published April 6, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in hauler 1.2.2-1.1.

References

Show 19 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open