p PatchFirst

CVE-2025-58438

CVE-2025-58438 · internetarchive is vulnerable to Directory Traversal through file downloads

This page contains facts from public vulnerability sources. Check the original advisory before updating.

internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library. The file.download() method does not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., ../../../../windows/system32/file.txt) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory. An attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used. The vulnerability is particularly critical for users on Windows systems, but all operating systems are affected. This issue is fixed in version 5.5.1.

CVSS 9.4 · Critical · EPSS 1.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • internetarchive

    Versions
    • < 5.5.1: Affected

    No fix published

  • python-internetarchive Debian:12

    Versions
    • 3.3.0-1
    Affected ranges
    • ECOSYSTEM: < 3.3.0-2~deb12u1

    Update to 3.3.0-2~deb12u1

  • python-internetarchive Debian:13

    Versions
    • 5.4.0-1
    Affected ranges
    • ECOSYSTEM: < 5.4.0-2~deb13u1

    Update to 5.4.0-2~deb13u1

  • python-internetarchive Debian:14

    Versions
    • 5.4.0-1
    • 5.4.0-2~deb13u1
    Affected ranges
    • ECOSYSTEM: < 5.5.1-1

    Update to 5.5.1-1

  • internetarchive PyPI

    Versions
    • 0.2.5
    • 0.2.6
    • 0.2.7
    • 0.2.8
    • 0.2.9
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 0.3.6
    • 0.3.7
    • 0.3.8
    • 0.3.9
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.4.5
    • 0.4.6
    • 0.4.7
    • 0.4.8
    • 0.4.9
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.4
    • 0.5.5
    • 0.5.7
    • 0.5.9
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.5
    • 0.6.6
    • 0.6.8
    • 0.6.9
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.7.8
    • 0.7.9
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.8.4
    • 0.8.5
    • 0.8.9
    • 0.9.0
    • 0.9.1
    • 0.9.2
    • 0.9.3
    • 0.9.5
    • 0.9.6
    • 0.9.7
    • 0.9.8
    • 1.0.0
    • 1.0.1
    • 1.0.10
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.7.5
    • 1.7.6
    • 1.7.7
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.8.3
    • 1.8.4
    • 1.8.5
    • 1.9.0
    • 1.9.2
    • 1.9.3
    • 1.9.4
    • 1.9.5
    • 1.9.6
    • 1.9.9
    • 2.0.0
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.1.0
    • 3.2.0
    • 3.3.0
    • 3.4.0
    • 3.5.0
    • 3.6.0
    • 3.7.0
    • 4.0.1
    • 4.1.0
    • 5.0.0
    • 5.0.1
    • 5.0.2
    • 5.0.3
    • 5.0.3.dev1
    • 5.0.4
    • 5.0.5
    • 5.1.0
    • 5.2.0
    • 5.2.1
    • 5.3.0
    • 5.3.1
    • 5.4.0
    • 5.4.1
    • 5.5.0
    Affected ranges
    • ECOSYSTEM: < 5.5.1

    Update to 5.5.1

  • python-internetarchive Ubuntu:Pro:20.04:LTS

    Versions
    • 1.8.1-1
    • 1.8.5-1
    • 1.9.0-2
    • 1.9.0-3
    Affected ranges
    • ECOSYSTEM: < 1.9.0-3ubuntu0.1~esm1

    Update to 1.9.0-3ubuntu0.1~esm1

  • python-internetarchive Ubuntu:22.04:LTS

    Versions
    • 1.9.9-1
    Affected ranges
    • ECOSYSTEM: < 1.9.9-1ubuntu0.1

    Update to 1.9.9-1ubuntu0.1

  • python-internetarchive Ubuntu:Pro:24.04:LTS

    Versions
    • 3.3.0-1
    • 3.5.0-1
    Affected ranges
    • ECOSYSTEM: < 3.5.0-1ubuntu0.1~esm1

    Update to 3.5.0-1ubuntu0.1~esm1

  • python-internetarchive Ubuntu:25.10

    Versions
    • 5.2.1-1
    • 5.3.1-1
    • 5.4.0-1
    Affected ranges
    • ECOSYSTEM: < 5.4.0-1ubuntu0.1

    Update to 5.4.0-1ubuntu0.1

Original sources

Check your server →