Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN590
_____________________________________________________________________

DATE                : 08/09/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running internetarchive versions prior
                                         to 5.5.1.

=====================================================================
https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp
_____________________________________________________________________


Directory Traversal in File.download()
Critical
jjjake published GHSA-wx3r-v6h7-frjp Sep 5, 2025

Package
internetarchive

Affected versions
<= 5.5.0

Patched versions
5.5.1


Description

Impact

What kind of vulnerability is it?
This is a Critical severity directory traversal (path traversal)
vulnerability in the File.download() method of the internetarchive
library.


Who is impacted?

All users of the internetarchive library versions < 5.5.1 are
impacted. The vulnerability is particularly critical for users on
Windows systems, but all operating systems are affected.

Description of the vulnerability:
The vulnerability existed because the file.download() method did
not properly sanitize user-supplied filenames or validate the final
download path. A maliciously crafted filename could contain path
traversal sequences (e.g., ../../../../windows/system32/file.txt)
or illegal characters that, when processed, would cause the file
to be written outside of the intended target directory.

Potential Impact:
An attacker could potentially overwrite critical system files or
application configuration files, leading to a denial of service,
privilege escalation, or remote code execution, depending on the
context in which the library is used.
Patches

Has the problem been patched?
Yes, the problem has been patched.

What versions should users upgrade to?
Users must upgrade to version 5.5.1 or later.


Workarounds

Is there a way for users to fix or remediate the vulnerability
without upgrading?

There is no direct workaround that does not involve upgrading
the library. The vulnerability is in the core logic of the file
download process.

The only alternative for users who absolutely cannot upgrade
is to implement their own custom download function that:

    Manually sanitizes all filenames using a robust method.
    Validates that the resolved absolute path of the download
target is within the intended directory before writing any
files.

However, this essentially re-implements the fix and is not
recommended. Upgrading to the patched version is the only
safe and supported solution.


References

    Release Notes for v5.5.1
    Commit with the fix
    CVE Identifier: CVE-2025-58438


Severity
Critical

CVE ID
CVE-2025-58438

Weaknesses
No CWEs

Credits

    @pengowray pengowray Finder



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================