CVE-2018-25046: Cloud Foundry Archiver Path Traversal Vulnerability
Summary
CVE-2018-25046: Cloud Foundry Archiver vulnerable to path traversal. Affects github.com/cloudfoundry/archiver versions < 0.0.0-20180523222229-09b5706aa936. Fixed in 0.0.0-20180523222229-09b5706aa936. How to fix ↓
Also tracked for
The same CVE-2018-25046 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cloud Foundry Archiver is a Go package that provides functionality for archiving and compressing files. It is commonly used in Cloud Foundry deployments to package and distribute applications. The package is vulnerable to a path traversal attack due to improper path sanitization. This vulnerability allows an attacker to include relative file paths in an archive, which can result in files being written or overwritten outside of the intended target directory.
Vulnerability Detail
The vulnerability arises from the lack of proper validation and sanitization of file paths within the Cloud Foundry Archiver package. When processing archives, the package fails to adequately prevent the inclusion of relative file paths. As a result, an attacker can craft a malicious archive that includes file paths that traverse outside of the intended target directory. This can lead to unauthorized access, modification, or deletion of files on the system. The impact of this vulnerability can be severe, as it allows an attacker to manipulate files and potentially compromise the integrity and security of the system.
How To Fix
Latest published version: v0.0.0-20200131002800-4ca7245c29b1 as of 22 Oct 2026
go get github.com/cloudfoundry/archiver@v0.0.0-20200131002800-4ca7245c29b1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20180523222229-09b5706aa936
This is the first release that contains the fix.
go get github.com/cloudfoundry/archiver@v0.0.0-20180523222229-09b5706aa936Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can implement their own path sanitization logic when processing archives. This can involve validating and normalizing file paths to ensure they are within the intended target directory and do not allow traversal outside of it. Here is an example of how this can be done in Go:
import (
"path/filepath"
)
func sanitizePath(path string) (string, error) {
absPath, err := filepath.Abs(path)
if err != nil {
return "", err
}
// Check if the absolute path is within the target directory
if !strings.HasPrefix(absPath, "/path/to/target/directory") {
return "", errors.New("Invalid file path")
}
return absPath, nil
}
Conclusion
The Cloud Foundry Archiver package is vulnerable to a path traversal attack due to improper path sanitization. This vulnerability can be exploited to manipulate files and compromise the integrity and security of the system. It is crucial to update to a fixed version of the package and implement proper path sanitization logic when processing archives. For additional support and guidance, contact DevNack.com.
See every vulnerability recorded for github.com/cloudfoundry/archiver →
FAQ
This vulnerability allows an attacker to manipulate files and potentially compromise the integrity and security of the system. They can read, modify, or delete files outside of the intended target directory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
Yes, the vulnerability has been fixed in version 0.0.0-20180523222229-09b5706aa936 of the Cloud Foundry Archiver package. It is recommended to update to this version or a later one to mitigate the vulnerability.
Yes, developers can implement their own path sanitization logic when processing archives to prevent path traversal. The provided workaround code snippet demonstrates how this can be done in Go.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing this vulnerability.
