Read the docs
TI-2024-00368 Aliases CVE-2024-0406GHSA-rhh4-rh7c-7r5v

Mholt/archiver: path traversal vulnerability

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00928 60th percentileScored 2026-11-07
Fix Partial archiver: v4.0.0Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—archiverv3.0.0 and laterv4.0.0Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.18—v4.18.0-202503051333.p0.g22b273d.assembly.stream.el9Patch availableCNA
Red HatRed Hat Advanced Cluster Security 3——No fix listedCNA
Red HatRed Hat Advanced Cluster Security 3——No fix listedCNA
Red HatRed Hat Advanced Cluster Security 3——No fix listedCNA
Red HatRed Hat Advanced Cluster Security 4——Not affectedCNA
Red HatRed Hat Advanced Cluster Security 4——Not affectedCNA
Red HatRed Hat Advanced Cluster Security 4——Not affectedCNA
—github.com/mholt/archiver/v3 (Go)3.0.0 – 3.5.1—No fix listedGHSA-rhh4-rh7c-7r5v
—github.com/mholt/archiver (Go)3.0.0 – 3.5.1—No fix listedGHSA-rhh4-rh7c-7r5v
  • archiver Vendor— Affected v3.0.0 and later Fixed in v4.0.0 Patch available CNA
  • Red Hat OpenShift Container Platform 4.18 VendorRed Hat Affected — Fixed in v4.18.0-202503051333.p0.g22b273d.assembly.stream.el9 Patch available CNA
  • Red Hat Advanced Cluster Security 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Advanced Cluster Security 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Advanced Cluster Security 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Advanced Cluster Security 4 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Advanced Cluster Security 4 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Advanced Cluster Security 4 VendorRed Hat Affected — Fixed in — Not affected CNA
  • github.com/mholt/archiver/v3 (Go) Vendor— Affected 3.0.0 – 3.5.1 Fixed in — No fix listed GHSA-rhh4-rh7c-7r5v
  • github.com/mholt/archiver (Go) Vendor— Affected 3.0.0 – 3.5.1 Fixed in — No fix listed GHSA-rhh4-rh7c-7r5v

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:mholt:archiver:*:*:*:*:*:*:*:*3.0.0 to before 4.0.0Vulnerablemholt
cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*4.18 to before 4.18.4VulnerableRed Hat
  • cpe:2.3:a:mholt:archiver:*:*:*:*:*:*:*:* Versions 3.0.0 to before 4.0.0 Vulnerable ·mholt
  • cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* Versions 4.18 to before 4.18.4 Vulnerable ·Red Hat

Remediation

  • Fix · CNA archiver Fixed in v4.0.0

Red Hat 1 advisory

  • RHSA-2025:2449 Released 2025-03-11 · Red Hat rating Important
    OpenShift Container Platform 4.18.4 security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-docker-builder-rhel9, openshift4/ose-nutanix-machine-controllers-rhel9 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:2449
Not affected: 2 products
  • Red Hat Advanced Cluster Security 4
  • Red Hat OpenShift Container Platform 4.18

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-0406
  2. 2026-10-03 Alias added: GHSA-rhh4-rh7c-7r5v

References

Advisory 4

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2022-01762 Exposure of resource to wrong sphere in Red Hat Advanced Cluster Security for Kubernetes CVSS 3.1HIGH 8.8
  • TI-2023-04563 Stackrox: missing http security headers allows for clickjacking in web ui CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences