CVE-2018-1002207: Arbitrary File Write via Archive Extraction in github.com/mholt/archiver
Summary
CVE-2018-1002207: Arbitrary File Write via Archive Extraction in mholt/archiver in github.com/mholt/archiver. Affects github.com/mholt/archiver versions < 2.1.0+incompatible. Fixed in 2.1.0+incompatible. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/mholt/archiver is a Go library that provides functionality for creating and extracting various archive formats. It is widely used in Go applications for handling file compression and decompression tasks. However, a vulnerability has been discovered in the package that allows arbitrary file write during the extraction process.
Vulnerability Detail
The vulnerability in github.com/mholt/archiver allows an attacker to write arbitrary files to the file system when extracting archives. This can lead to unauthorized modification or creation of files, potentially enabling further attacks or unauthorized access to sensitive information. The vulnerability originates from improper handling of file paths during the extraction process.
How To Fix
Latest published version: v3.1.1+incompatible as of 23 Oct 2026
go get github.com/mholt/archiver@v3.1.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.0+incompatible
This is the first release that contains the fix.
go get github.com/mholt/archiver@v2.1.0+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package to address the issue.
Conclusion
The vulnerability in github.com/mholt/archiver allows arbitrary file write during archive extraction, potentially leading to unauthorized file modification or creation. It is crucial to update the package to the fixed version to mitigate the vulnerability.
See every vulnerability recorded for github.com/mholt/archiver →
FAQ
The vulnerability allows an attacker to write arbitrary files to the file system, potentially leading to unauthorized modification or creation of files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground and it will alert you if the vulnerability is present.
There are no known public exploits for this vulnerability at the moment. However, it is important to address the issue promptly by updating the package to the fixed version.
No, updating the package to the fixed version is the only known way to mitigate the vulnerability. It is recommended to update your application as soon as possible.
In addition to updating the package, it is always recommended to follow secure coding practices and perform regular security assessments of your application to identify and address any potential vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mholt/archiver.
