internetarchive File.download() विधि में डायरेक्टरी ट्रावर्सल (Directory Traversal) के लिए असुरक्षित

The internetarchive library's file.download() method is vulnerable to path traversal due to insufficient sanitization of user-supplied filenames. An attacker could craft a malicious filename that, when processed by the library, leads to the download of files outside the intended directory. This could allow them to access sensitive system files, configuration data, or even execute arbitrary code if the downloaded file is then processed by another application. The vulnerability is particularly concerning on Windows systems, but affects all operating systems where the library is used. Successful exploitation could lead to complete system compromise.

Python developers and system administrators using the internetarchive library in their applications are at risk. This includes those deploying applications that rely on the library for file downloading or processing, particularly those running on Windows systems where the impact of file access is greater. Applications using older, unpatched versions of the library are particularly vulnerable.

• python / library: Inspect your project's dependencies for versions of internetarchive less than 5.5.1 using pip list or poetry show. • python / library: Monitor for unusual file download activity from your application logs, particularly requests containing directory traversal sequences like ../. • generic web: Monitor web server access logs for requests to the internetarchive library's download endpoint with suspicious filenames. • generic web: Check for unexpected files appearing in the application's download directory.

1. 2025-09-05Disclosure

   disclosure

1. आरक्षित2025-09-01
2. प्रकाशित2025-09-05
3. संशोधित2025-11-03
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-58438 is to upgrade the internetarchive library to version 5.5.1 or later. If upgrading is not immediately feasible, consider implementing strict input validation on any filenames passed to the file.download() method. This should include whitelisting allowed characters and preventing the use of directory traversal sequences (e.g., ../). While a WAF or proxy is unlikely to directly mitigate this vulnerability, it could be configured to monitor for suspicious file download requests. After upgrading, confirm the fix by attempting to download a file using a crafted filename containing directory traversal sequences; the download should fail with an appropriate error.