Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1260426

Bug#1114635: python-internetarchive: CVE-2025-58438: Directory Traversal in File.download()

Show all headers | View raw

Source: python-internetarchive
Version: 5.4.0-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for python-internetarchive.

CVE-2025-58438[0]:
| internetarchive is a Python and Command-Line Interface to
| Archive.org In versions 5.5.0 and below, there is a directory
| traversal (path traversal) vulnerability in the File.download()
| method of the internetarchive library. The file.download() method
| does not properly sanitize user-supplied filenames or validate the
| final download path. A maliciously crafted filename could contain
| path traversal sequences (e.g.,
| ../../../../windows/system32/file.txt) or illegal characters that,
| when processed, would cause the file to be written outside of the
| intended target directory. An attacker could potentially overwrite
| critical system files or application configuration files, leading to
| a denial of service, privilege escalation, or remote code execution,
| depending on the context in which the library is used.  The
| vulnerability is particularly critical for users on Windows systems,
| but all operating systems are affected. This issue is fixed in
| version 5.5.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-58438
    https://www.cve.org/CVERecord?id=CVE-2025-58438
[1] https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp
[2] https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1114635: python-internetarchive: CVE-2025-58438: Directory Traversal in File.download() Salvatore Bonaccorso <carnil@debian.org> - 2025-09-07 20:40 +0200
  Bug#1114635: python-internetarchive: CVE-2025-58438: Directory Traversal in File.download() Antoine Beaupré <anarcat@debian.org> - 2025-09-08 16:10 +0200
    Bug#1114635: python-internetarchive: CVE-2025-58438: Directory Traversal in File.download() Antoine Beaupré <anarcat@debian.org> - 2025-09-09 20:10 +0200
      Bug#1114635: python-internetarchive: CVE-2025-58438: Directory Traversal in File.download() Salvatore Bonaccorso <carnil@debian.org> - 2025-09-11 22:10 +0200
  Bug#1114635: python-internetarchive: CVE-2025-58438: Directory Traversal in File.download() Moritz Mühlenhoff <jmm@inutil.org> - 2025-09-18 22:10 +0200

csiph-web