CVE-2024-10389: Safearchive Path Traversal vulnerability

November 4, 2024 (updated July 23, 2025)

There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc

References

github.com/advisories/GHSA-q3rp-vvm7-j8jg
github.com/google/safearchive
github.com/google/safearchive/commit/f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc
nvd.nist.gov/vuln/detail/CVE-2024-10389

Code Behaviors & Features

Detect and mitigate CVE-2024-10389 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →