CVE-2024-0406: Mholt Archiver Path Traversal Vulnerability

CVE-2024-0406 Overview

CVE-2024-0406 is a path traversal vulnerability [CWE-22] in the mholt/archiver Go package. The library fails to properly validate file paths inside tar archives during extraction. An attacker who crafts a malicious tar file can write or overwrite files outside the intended extraction directory when a victim unpacks the archive. Files are created with the privileges of the user or application invoking the library, enabling arbitrary file write and potential code execution paths. The flaw also affects downstream Red Hat products, including Red Hat Advanced Cluster Security and Red Hat OpenShift Container Platform, which embed the vulnerable component.

Critical Impact
A crafted tar archive can overwrite arbitrary files on the host during extraction, leading to privilege escalation or code execution in the context of the extracting process.

Affected Products

mholt archiver (all versions prior to fixed release)
Red Hat Advanced Cluster Security 3.0
Red Hat OpenShift Container Platform

Discovery Timeline

2024-04-06 - CVE-2024-0406 published to the National Vulnerability Database (NVD)
2025-03-11 - Red Hat published security erratum RHSA-2025:2449
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0406

Vulnerability Analysis

The vulnerability resides in how mholt/archiver processes filenames stored inside tar archives. The library extracts entries without normalizing or validating the destination path against the intended output directory. This is a classic Zip Slip variant applied to tar archives, tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Because extraction runs with the caller's privileges, the impact scales with how the library is embedded. In server-side pipelines that process user-supplied archives, an attacker can overwrite configuration files, systemd units, SSH authorized_keys files, or binaries writable by the service account. In container security tooling such as Red Hat Advanced Cluster Security, the extractor may run with elevated privileges when scanning images, amplifying the impact.

Root Cause

The root cause is missing sanitization of tar header Name fields. Entries containing sequences such as ../../etc/cron.d/malicious or absolute paths like /etc/passwd are written verbatim under the destination directory. Without a canonical path check that verifies the resolved output stays inside the target directory, path traversal succeeds.

Attack Vector

Exploitation requires the target application to extract an attacker-controlled tar file, so user interaction is needed. The attack executes locally within the process performing extraction. A typical exploitation flow: the attacker crafts a tar containing entries with traversal sequences in their names, delivers the archive through any ingestion path the application accepts (upload endpoint, artifact pull, image layer), and waits for the application to call the vulnerable Unarchive or Extract functions. The library then writes the malicious payload to a location chosen by the attacker.

No verified public exploit code is available. See the Red Hat CVE Details and Red Hat Bug Report #2257749 for technical background.

Detection Methods for CVE-2024-0406

Indicators of Compromise

Files written outside the expected extraction directory by processes that invoke mholt/archiver, particularly writes to sensitive paths such as /etc/, ~/.ssh/, or systemd unit directories.
Tar archives containing entries whose names include ../ sequences or absolute paths when inspected with tar -tvf.
Unexpected modifications to binaries or configuration files immediately following an archive extraction event in application logs.

Detection Strategies

Perform software composition analysis (SCA) on Go modules to identify applications that import github.com/mholt/archiver at vulnerable versions.
Inspect incoming tar archives for entries with traversal or absolute path components before passing them to the extractor.
Correlate process execution telemetry to flag file writes outside a documented extraction working directory.

Monitoring Recommendations

Enable file integrity monitoring on sensitive directories (/etc, /usr/bin, /root/.ssh, cron directories) on hosts running affected services.
Monitor Red Hat Advanced Cluster Security and OpenShift audit logs for anomalous file modifications originating from image scanning or archive processing workflows.
Alert on process ancestry where a web-facing service spawns file writes to system paths shortly after handling uploaded archives.

How to Mitigate CVE-2024-0406

Immediate Actions Required

Upgrade mholt/archiver to a patched release across all Go applications that depend on it, and rebuild affected binaries.
Apply Red Hat erratum RHSA-2025:2449 to Red Hat Advanced Cluster Security and OpenShift Container Platform deployments.
Audit application code paths that call archiver.Unarchive, archiver.Extract, or related APIs, and validate that inputs come from trusted sources.

Patch Information

Red Hat addressed the flaw through erratum RHSA-2025:2449 for Red Hat Advanced Cluster Security 3.0 and Red Hat OpenShift Container Platform. Consult the Red Hat CVE Details page for the full list of fixed package versions and channels. Applications embedding mholt/archiver directly should update the module dependency and rebuild.

Workarounds

Reject or sandbox archive extraction from untrusted sources until the patched library is deployed.
Run extraction processes under a dedicated low-privilege service account with a restricted chroot or container filesystem view.
Pre-validate tar contents by rejecting any entry whose resolved path escapes the intended extraction root.

bash

# Example: validate tar entries before extraction
tar -tvf suspicious.tar | awk '{print $NF}' | \
  grep -E '^(/|.*\.\./)' && echo "Path traversal detected - reject archive"

# Update Go module dependency to the patched release
go get github.com/mholt/archiver/v3@latest
go mod tidy