Critical, CVSS 9.4PyPIAmendedPublished
internetarchive Vulnerable to Directory Traversal in File.download()
CVE-2025-58438 · GHSA-wx3r-v6h7-frjp
- Affected
- PyPI internetarchive < 5.5.1
- Fixed in
- 5.5.1· Vendor fix available
- Issue
- Impact What kind of vulnerability is it? This is a Critical severity directory traversal (path traversal) vulnerability in the `File.download()` method of the `internetarchive` library. Who is impacted? All users of the `internetarchive` library versions `< 5.5.1` are impacted. The vulnerability is particularly critical for users on Windows systems, but all operating systems are affected. Description of the vulnerability: The vulnerability existed because the `file.download()` method did not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., `../../../../windows/system32/file.txt`) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory. Potential Impact: An attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service,…
Recommended action: Upgrade to 5.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.