CVE-2025-58438

描述

internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library. The file.download() method does not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., ../../../../windows/system32/file.txt) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory. An attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used. The vulnerability is particularly critical for users on Windows systems, but all operating systems are affected. This issue is fixed in version 5.5.1.

如何修補 CVE-2025-58438

要修補 CVE-2025-58438,請將受影響套件升級到下列已修補版本。

• —升級至 1.9.9-1+deb11u1 或更新版本
• —升級至 1.9.9-1+deb11u1 或更新版本
• —升級至 3.3.0-2~deb12u1 或更新版本
• —升級至 5.5.1 或更新版本

CVE-2025-58438 正在被利用嗎?

低 — EPSS 為 3.8%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 1.9.9-1+deb11u1
• from 0, < 1.9.9-1+deb11u1
• from 0, < 3.3.0-2~deb12u1
• from 0, < 5.5.1

CVSS 分數

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-58438
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-58438
• PATCHgithub.com/jjjake/internetarchive
• WEBgithub.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2