Description
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | archiver | v3.0.0 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat Advanced Cluster Security 3 | — | — |
| Red Hat | Red Hat Advanced Cluster Security 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hauler | 1.2.2-1.1 | openSUSE-SU-2025:14996-1 |
| openSUSE Tumbleweed | subfinder | 2.7.0-2.1 | openSUSE-SU-2025:15004-1 |
| openSUSE Leap 16.0 | hauler | 1.3.1-bp160.1.1 | openSUSE-SU-2025:20160-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | filebrowser | 2.45.0-r0 | — |
| Wolfi rolling | k9s | 0.32.4-r3 | — |
| Wolfi rolling | kots | 1.128.3-r0 | — |
| Wolfi rolling | kubescape | 3.0.10-r0 | — |
| Wolfi rolling | nuclei | 3.2.5-r1 | — |
| Wolfi rolling | terragrunt +1 | 0.64.0-r0 | — |
| Wolfi rolling | wolfictl | 0.16.6-r1 | — |
| Wolfi rolling | zarf | 0.33.1-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
walidpyh/CVE-2024-0406-POC ★ 5 · Mar 12, 2025
CVE-2024-0406 POC using symlinks
-
veissa/Desires ★ 0 · Mar 29, 2025
vulnerable web app CVE-2024-0406 go cve
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mholt/archiver | >= 3.0.0, <= 3.5.1 | — | GHSA-rhh4-rh7c-7r5v |
| Go | github.com/mholt/archiver | all versions | — | GO-2024-2698 |
| Go | github.com/mholt/archiver/v3 | >= 3.0.0, <= 3.5.1 | — | GHSA-rhh4-rh7c-7r5v |
| Go | github.com/mholt/archiver/v3 | all versions | — | GO-2024-2698 |
Advisories 5
- WID-SEC-2025-0001 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- openSUSE-SU-2025:20160-1 Security update for hauler SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:14996-1 hauler-1.2.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15004-1 subfinder-2.7.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1755 Gitea: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 14, 2025
References
- RHSA-2025:2449 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-0406 vdb-entry
- RHBZ#2257749 issue-tracking