Threat Investigation
Request a demo

CVE-2024-10389

High

Description

There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc

SeverityHigh
CVSS7.5
Exploit probability—
ProductGoogle Safearchive
PublishedNov 4, 2024
First seenNov 4, 2024
Weakness typeCWE-427CWE-427

How to fix

Update
  • google safearchive2024-10-25 or later
  • github.com/google/safearchive0.0.0-20241025131057-f7ce9d7b6f9c or later

Affected products

ProductAffected versionsFixed in
google safearchivev < 2024-10-252024-10-25
github.com/google/safearchiveGov < 0.0.0-20241025131057-f7ce9d7b6f9c0.0.0-20241025131057-f7ce9d7b6f9c

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.