Skip to content
OpenAdvisories
Critical USN-7989-1 1 CVE

python-internetarchive vulnerability

Published Feb 2, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Pengo Wray discovered that The Internet Archive Python Library incorrectly
handled certain file paths when downloading files. An attacker could
possibly use this issue to write files to arbitrary locations on the file
system.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS python-internetarchive 1.9.9-1ubuntu0.1
Ubuntu · 25.10 python-internetarchive 5.4.0-1ubuntu0.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-internetarchive 1.9.0-3ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS python-internetarchive 3.5.0-1ubuntu0.1~esm1

Vulnerabilities 1

  • Critical 9.4
    CVE-2025-58438

    internetarchive is vulnerable to Directory Traversal through file downloads

    internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library. The file.download() method does not …

    jjjake internetarchive python-internetarchive internetarchive Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2025-58438