{"id":"CVE-2024-57966","aliases":["DEBIAN-CVE-2024-57966","DLA-4046-1","DSA-6029-1","EUVD-2024-53866","GHSA-v9cx-qp5g-qchc","MGASA-2025-0061","OESA-2025-1130","OESA-2025-1131","OESA-2025-1132","OESA-2025-1133","UBUNTU-CVE-2024-57966","openSUSE-SU-2025:0090-1"],"status":"published","title":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","description":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00277,"percentile":0.20383,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-36"],"published":"2025-02-03T00:00:00Z","modified":"2026-11-02T12:03:11Z","fixes":[{"ecosystem":"Debian:12","package":"ark","fixed_in":["4:22.12.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ark","fixed_in":["4:24.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ark","fixed_in":["4:24.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"ark","fixed_in":["4:20.12.2-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"ark","fixed_in":["23.04.3-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"ark","fixed_in":["23.08.4-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"ark","fixed_in":["22.08.3-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"ark","fixed_in":["22.08.3-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"ark","fixed_in":["23.08.4-3.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"ark","fixed_in":["23.08.5-bp156.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"ark","fixed_in":["23.08.5-bp156.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:22.12.3-1+deb12u1"}]}],"versions":["4:22.12.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:20.12.2-1+deb11u1"}]}],"versions":["4:20.12.2-1"]},{"source":"osv","ecosystem":"Debian:12","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:22.12.3-1+deb12u1"}]}],"versions":["4:22.12.3-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.04.3-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.08.4-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.08.3-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.08.3-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.08.4-3.oe2403"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:15.08.2-0ubuntu1","4:15.12.1-0ubuntu1","4:15.12.3-0ubuntu1","4:15.12.3-0ubuntu1.1","4:15.12.3-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:17.04.3-0ubuntu3","4:17.08.3-0ubuntu1","4:17.08.3-0ubuntu2","4:17.12.2-0ubuntu1","4:17.12.3-0ubuntu1","4:17.12.3-0ubuntu1.1","4:17.12.3-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:19.04.3-0ubuntu2","4:19.08.1-1","4:19.08.3-0ubuntu1","4:19.12.0-0ubuntu1","4:19.12.0-1","4:19.12.1-0ubuntu1","4:19.12.2-0ubuntu1","4:19.12.3-0ubuntu1","4:19.12.3-0ubuntu1.1","4:19.12.3-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:21.08.1-0ubuntu2","4:21.08.2-1","4:21.08.3-1","4:21.11.80-0ubuntu1","4:21.11.90-0ubuntu1","4:21.11.90-0ubuntu2","4:21.12.0-0ubuntu1","4:21.12.1-0ubuntu1","4:21.12.2-0ubuntu1","4:21.12.3-0ubuntu1","4:21.12.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:23.08.1-0ubuntu1","4:23.08.2-0ubuntu1","4:23.08.3-0ubuntu1","4:23.08.4-0ubuntu1","4:23.08.5-0ubuntu1","4:23.08.5-0ubuntu3","4:23.08.5-0ubuntu4","4:23.08.5-0ubuntu5"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.08.5-bp156.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.08.5-bp156.2.3.1"}]}]}],"products":[{"vendor":"kde","product":"ark"}],"references":[{"url":"https://github.com/KDE/ark/commit/fe518d81b338941e0bf1c5ce5e75a9ab6de4bb58","tags":["fix","report"]},{"url":"https://github.com/KDE/ark/compare/v24.11.90...v24.12.0","tags":["web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00007.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57966","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v9cx-qp5g-qchc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57966.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-57966","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0061.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34013","tags":["report"]},{"url":"https://kde.org/info/security/advisory-20250207-1.txt","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1130","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1131","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1132","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1133","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-57966","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-57966","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RI4I3ZX4BWBV5GDWRKOZMO66ATH4GNIL/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236737","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57966","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-57966","description":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","status":"published","published":"2025-02-03T00:00:00Z","modified":"2025-02-09T05:02:36.861Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-53866","description":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","status":"published","published":"2025-02-03T00:00:00Z","modified":"2025-02-09T05:02:36Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:01.319038Z"}],"ghsa":[{"id":"GHSA-v9cx-qp5g-qchc","title":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","description":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","status":"published","published":"2025-02-03T06:30:53Z","modified":"2025-02-09T06:31:52Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:59:51.123256Z"}],"nvd":[{"id":"CVE-2024-57966","description":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","status":"published","published":"2025-02-03T05:15:10.08Z","modified":"2026-06-17T08:14:20.22Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:10:43.581383Z"}],"osv":[{"id":"CVE-2024-57966","description":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","status":"published","published":"2025-02-03T00:00:00Z","modified":"2026-10-28T10:42:18.345026426Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"DEBIAN-CVE-2024-57966","description":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","status":"published","published":"2025-02-03T05:15:10.08Z","modified":"2026-11-02T12:03:11.735175542Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"OESA-2025-1130","title":"ark security update","description":"Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha (if appropriate command-line programs are installed).\r\n\r\nSecurity Fix(es):\n\nlibarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.(CVE-2024-57966)","status":"published","published":"2025-02-14T11:08:13Z","modified":"2026-08-18T01:18:46.943298962Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1131","title":"ark security update","description":"Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha (if appropriate command-line programs are installed).\r\n\r\nSecurity Fix(es):\n\nlibarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.(CVE-2024-57966)","status":"published","published":"2025-02-14T11:08:13Z","modified":"2026-08-18T01:18:46.797750068Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1132","title":"ark security update","description":"Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha (if appropriate command-line programs are installed).\r\n\r\nSecurity Fix(es):\n\nlibarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.(CVE-2024-57966)","status":"published","published":"2025-02-14T11:08:13Z","modified":"2026-08-18T01:18:46.739510632Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1133","title":"ark security update","description":"Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha (if appropriate command-line programs are installed).\r\n\r\nSecurity Fix(es):\n\nlibarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.(CVE-2024-57966)","status":"published","published":"2025-02-14T11:08:13Z","modified":"2026-08-18T01:18:46.790174044Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-57966","description":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","status":"published","published":"2025-02-03T05:15:00Z","modified":"2025-10-24T05:16:08Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"DLA-4046-1","title":"ark - security update","status":"published","published":"2025-02-08T00:00:00Z","modified":"2026-03-09T01:23:37.922774Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-6029-1","title":"ark - security update","status":"published","published":"2025-10-20T00:00:00Z","modified":"2025-10-20T16:17:28.272378Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0061","title":"Updated ark packages fix security vulnerability","description":"A security issue exists in Ark where a maliciously crafted archive containing\nfile paths beginning with \"/\" allows files to be extracted to locations\noutside the intended directory.\n","status":"published","published":"2025-02-13T19:09:12Z","modified":"2026-04-16T04:40:48.183796606Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:0090-1","title":"Security update for ark","description":"This update for ark fixes the following issues:\n\n- CVE-2024-57966: Disable extraction to absolute path from an archive (boo#1236737)\n","status":"published","published":"2025-03-12T17:29:59Z","modified":"2026-02-04T03:00:27.344964Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}