Critical Path Traversal Vulnerability in python-internetarchive Package
Summary
CVE-2025-58438: internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive librar... Affects python-internetarchive across 2 version ranges.
< 73141dbdd8039731c6344f2f29f74865c91e9533
< cba2d459e10a9489fb35caeba0b03e80f5f5d7c2
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-internetarchive package is a Python library and Command-Line Interface designed to interact with Archive.org, allowing users to download and manage digital content from the Internet Archive. It provides functionalities for accessing archived web pages, books, and other media. However, versions 5.5.0 and below are vulnerable to a critical directory traversal vulnerability that can lead to severe security risks.
Vulnerability Detail
In versions 5.5.0 and below of the python-internetarchive package, a directory traversal vulnerability exists in the File.download() method. This vulnerability arises from improper sanitization of user-supplied filenames and inadequate validation of the final download path. An attacker can exploit this flaw by crafting malicious filenames containing path traversal sequences (e.g., ../../../../windows/system32/file.txt) or illegal characters. This could allow the attacker to write files outside the intended directory, potentially overwriting critical system files or application configurations, leading to denial of service, privilege escalation, or remote code execution. The vulnerability is particularly critical for users on Windows systems but affects all operating systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid using the File.download() method with untrusted or user-supplied filenames until the package is updated. Implementing additional filename validation and sanitization in the application code can also help mitigate the risk.
Conclusion
The python-internetarchive package has a critical directory traversal vulnerability in versions 5.5.0 and below, which can lead to severe security risks. Users are strongly advised to update to version 5.5.1 or later to mitigate this risk. Additionally, implementing workarounds and monitoring for vulnerabilities using tools like Vulert can enhance security.
See every vulnerability recorded for python-internetarchive →
FAQ
The vulnerability is a directory traversal issue that allows attackers to manipulate file paths and potentially overwrite critical files on the system.
Versions 5.5.0 and below are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used.
Yes, the vulnerability has been fixed in version 5.5.1 of the python-internetarchive package. Users should update to this version or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-internetarchive.
