Libarchive: Arbitrary file write via path traversal in unpackToDir
Affects libarchiveSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 3.0.6.0
Data as of 13 Nov 2026, 14:17 UTC
What to do
Upgrade libarchive to 3.0.6.0.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagelibarchive | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to libarchive version 3.0.6.0 or later, which rejects archive entries with leading '..' path components. If upgrading is not possible, validate archive entry names before extraction to reject absolute paths and any path containing '..' components. Alternatively, perform extraction inside a sandboxed directory to contain potential traversal.
Description
A path traversal vulnerability in libarchive's unpackToDir function allows an attacker to write arbitrary files outside the intended extraction directory. This occurs because entry names starting with '..' are not validated and are passed to libarchive without secure extraction flags. This can lead to arbitrary file writes with the extracting process's privileges, potentially enabling code execution if malicious files are planted. The issue is fixed in libarchive version 3.0.6.0.