CVE-2025-3445: mholt/archiver Path Traversal Vulnerability in ZIP File Handling
Summary
CVE-2025-3445: mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File. Affects github.com/mholt/archiver versions < 3.5.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mholt/archiver is a Go library designed for archiving and unarchiving files in various formats, including ZIP and TAR. It provides a simple interface for developers to manage file compression and extraction. However, the library has been identified as vulnerable to a Path Traversal attack, specifically through crafted ZIP files, which can lead to severe security issues.
Vulnerability Detail
A Path Traversal 'Zip Slip' vulnerability exists in mholt/archiver, allowing attackers to exploit crafted ZIP files containing symlinks that traverse directories. When the archiver.Unarchive function is used, these malicious ZIP files can overwrite or create files on the system with the same privileges as the executing application. This can result in sensitive files being compromised, privilege escalation, and potential code execution. The vulnerability affects versions up to 3.5.1 of the library.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the Unarchive function with untrusted ZIP files. Implement additional validation checks on ZIP file contents before extraction to mitigate the risk of exploitation.
Conclusion
The mholt/archiver library is vulnerable to a Path Traversal attack through crafted ZIP files, which can lead to serious security risks. Users are advised to update to the mholt/archives library or implement workarounds until a permanent fix is applied. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for github.com/mholt/archiver →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to sensitive file overwrites, privilege escalation, and potentially arbitrary code execution.
The original mholt/archiver project has been deprecated, and while a fix was implemented, it has not been officially released. Transitioning to mholt/archives is recommended.
If an immediate update is not possible, avoid using the vulnerable Unarchive function and implement strict validation on ZIP file contents.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mholt/archiver.
