A critical directory traversal vulnerability exists in the File.download() method of the internetarchive library versions prior to 5.5.1. This flaw allows malicious filenames containing path traversal sequences to cause files to be written outside the intended directory, potentially overwriting critical system or application files. The vulnerability affects all operating systems but is especially critical on Windows. The issue has been patched in version 5.5.1, and upgrading is the recommended remediation.