CVE-2025-64346 in archives
Summary
by MITRE • 11/07/2025
archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the program that imports it. Severity depends on user permissions, environment and how arbitrary archives are passed. This issue is fixed in version 1.0.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/07/2025
The CVE-2025-64346 vulnerability affects the archives Go library version 1.0.0, which is designed for extracting various archive formats including tar and zip files. This library serves as a foundational component for applications that need to process compressed data, making it a critical element in many software systems. The vulnerability stems from insufficient input validation and sanitization mechanisms within the archive extraction process, creating a pathway for malicious actors to exploit the library through crafted archive files.
The technical flaw manifests in the library's failure to properly handle maliciously constructed archive entries that could contain path traversal sequences or symbolic links pointing to arbitrary locations on the filesystem. When a malicious user feeds a specially crafted archive to the library, the extraction process can be manipulated to execute arbitrary code on the system where the library is running. This occurs because the library does not adequately validate file paths or entry names within archive files, allowing attackers to specify absolute paths or traverse directories beyond the intended extraction scope. The vulnerability can lead to remote code execution when the library is used in applications that process untrusted archive data, particularly in web applications or services that accept file uploads.
The operational impact of this vulnerability varies significantly based on the execution context and user permissions of the application utilizing the library. If the library runs with elevated privileges such as root or administrator access, the potential for system compromise becomes severe, potentially allowing attackers to gain full control over the affected system. The vulnerability can also enable attackers to modify or delete critical files, inject malicious code into existing programs, or establish persistent backdoors within the target environment. The severity classification depends heavily on the environment where the library is deployed, with web applications being particularly at risk since they often process user-supplied archive files without adequate sanitization.
The fix implemented in version 1.0.1 addresses the core issue by introducing comprehensive input validation and sanitization measures within the archive extraction process. The updated library now properly validates all file paths and entry names, implementing strict checks to prevent path traversal attacks and other malicious manipulation techniques. This remediation aligns with security best practices outlined in the CWE database under CWE-22 Path Traversal and CWE-78 Improper Neutralization of Special Elements used in OS Command Injection, which are directly applicable to the vulnerability conditions described. Organizations should prioritize upgrading to version 1.0.1 or later to mitigate this risk, while also implementing additional security measures such as running applications with minimal required privileges, implementing proper input validation at multiple layers, and monitoring for suspicious archive processing activities. The ATT&CK framework categorizes this vulnerability under T1059 Command and Scripting Interpreter and T1203 Exploitation for Client Execution, highlighting the potential for attackers to leverage this weakness for broader system compromise.