CVE-2025-3445: Path Traversal in Archiver Go Library

An attacker exploiting this vulnerability can leverage a specially crafted ZIP file to navigate outside the intended directory structure and access sensitive files on the server. This could include configuration files, source code, or even system files, depending on the permissions of the process running the mholt/archiver library. The potential for data exfiltration and system compromise is significant. While direct remote code execution is unlikely, the ability to read arbitrary files could be a stepping stone for further attacks, such as privilege escalation or information disclosure.

1. Reserved2025-04-08
2. Published2025-08-05
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-3445 is to upgrade the github.com/mholt/archiver library to version 3.0.1 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization on ZIP file contents before processing them with the library. Specifically, rigorously validate the file paths extracted from the ZIP archive to ensure they remain within the expected directory. WAF rules can be implemented to block uploads of ZIP files with suspicious path traversal patterns (e.g., ../). After upgrading, confirm the fix by attempting to extract a malicious ZIP file containing path traversal sequences and verifying that access is denied.