CVE-2025-58438: internetarchive Directory Traversal Vulnerability in File.download() Method
Summary
CVE-2025-58438: internetarchive Vulnerable to Directory Traversal in File.download(). Affects internetarchive versions < 5.5.1. Fixed in 5.5.1. How to fix ↓
Also tracked for
- python-internetarchive · Debian:11
The same CVE-2025-58438 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The internetarchive library is a Python package that allows users to interact with the Internet Archive's APIs, enabling functionalities such as downloading and uploading files from the archive. It is widely used for accessing historical web content and digital media. However, versions prior to 5.5.1 are vulnerable to a critical directory traversal issue that can lead to severe security risks.
Vulnerability Detail
The vulnerability is a critical directory traversal flaw in the File.download() method of the internetarchive library. It arises from the method's failure to properly sanitize user-supplied filenames or validate the final download path. This oversight allows attackers to craft malicious filenames containing path traversal sequences (e.g., ../../../../windows/system32/file.txt), potentially leading to the overwriting of critical system files or application configuration files. The impact can range from denial of service to privilege escalation or remote code execution, depending on the context of the library's usage.
How To Fix
Latest published version: 5.12.1 as of 23 Oct 2026
pip install --upgrade "internetarchive==5.12.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.5.1
This is the first release that contains the fix.
pip install --upgrade "internetarchive==5.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no direct workaround that does not involve upgrading the library. However, if upgrading is not possible, users can implement a custom download function that manually sanitizes filenames and validates the resolved absolute path. Here is a basic example of such a function:
def safe_download(file_name, target_directory):
import os
# Sanitize the filename
safe_file_name = os.path.basename(file_name)
# Construct the full path
full_path = os.path.join(target_directory, safe_file_name)
# Validate the path
if os.path.commonpath([full_path, target_directory]) == target_directory:
# Proceed with the download logic
pass # Replace with actual download code
else:
raise ValueError('Invalid download path')
Conclusion
The internetarchive library has a critical directory traversal vulnerability (CVE-2025-58438) that affects versions prior to 5.5.1. Users are strongly advised to upgrade to the patched version to mitigate potential security risks. Implementing custom workarounds is not recommended as they may not fully address the issue.
See every vulnerability recorded for internetarchive →
FAQ
CVE-2025-58438 is a critical directory traversal vulnerability in the internetarchive library that allows attackers to manipulate file paths and potentially overwrite system files.
All versions of the internetarchive library prior to 5.5.1 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
The vulnerability can lead to denial of service, privilege escalation, or remote code execution, depending on how the library is used in your application.
Yes, the vulnerability has been patched in version 5.5.1 of the internetarchive library. Users should upgrade to this version or later.
