Read the docs
TI-2024-09620 Aliases CVE-2024-10389GHSA-q3rp-vvm7-j8jg

Path Traversal in Safearchive

Priority LOW 26CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-427.

Summary

There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Fix Fixed github.com/google/safearchive (Go): 0.0.0-20241025131057-f7ce9d7b6f9c

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/google/safearchive (Go)before 0.0.0-20241025131057-f7ce9d7b6f9c0.0.0-20241025131057-f7ce9d7b6f9cPatch availableGHSA-q3rp-vvm7-j8jg
  • github.com/google/safearchive (Go) Vendor— Affected before 0.0.0-20241025131057-f7ce9d7b6f9c Fixed in 0.0.0-20241025131057-f7ce9d7b6f9c Patch available GHSA-q3rp-vvm7-j8jg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:google:safearchive:*:*:*:*:*:*:*:*before 2024-10-25VulnerableGoogle
  • cpe:2.3:a:google:safearchive:*:*:*:*:*:*:*:* Versions before 2024-10-25 Vulnerable ·Google

Remediation

  • Fix · GHSA-q3rp-vvm7-j8jg github.com/google/safearchive (Go) Fixed in 0.0.0-20241025131057-f7ce9d7b6f9c Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10389
  2. 2026-10-03 Alias added: GHSA-q3rp-vvm7-j8jg

References

Patch 1

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences