CVE-2024-55587: python-libarchive Path Traversal Flaw

CVE-2024-55587 Overview

CVE-2024-55587 is a directory traversal vulnerability in the python-libarchive library through version 4.2.1. The flaw resides in the extract function within zip.py, which is invoked by ZipFile.extractall and ZipFile.extract. An attacker can craft a ZIP archive containing entries with path traversal sequences that escape the intended extraction directory. When a victim application extracts the archive, files are written to attacker-controlled locations on the filesystem outside the target directory. The weakness maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as the Zip Slip class of vulnerabilities.

Critical Impact
Attackers can write arbitrary files outside the extraction directory, enabling overwrite of sensitive files, placement of malicious payloads in startup or web-accessible paths, and potential code execution in the context of the extracting application.

Affected Products

python-libarchive versions through 4.2.1
Applications that invoke ZipFile.extractall from python-libarchive
Applications that invoke ZipFile.extract from python-libarchive

Discovery Timeline

2024-12-12 - CVE-2024-55587 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55587

Vulnerability Analysis

The vulnerability exists in the extract routine of libarchive/zip.py in the smartfile/python-libarchive project. The extraction logic uses filenames sourced directly from ZIP archive entries when constructing output paths. Because the code does not normalize or validate these member names, an entry named with parent-directory sequences such as ../../etc/cron.d/payload resolves outside the caller-supplied destination. This is the canonical Zip Slip pattern. Both ZipFile.extractall and the single-entry ZipFile.extract share the vulnerable code path, so any caller using either API is exposed. The maintainer discussion and proposed fix are tracked in the python-libarchive issue tracker and the associated pull request.

Root Cause

The extract function at libarchive/zip.py line 107 concatenates the archive entry name to the destination path without verifying that the resulting path remains within the destination directory. Missing canonicalization checks, such as comparing the resolved absolute path against the resolved destination root, allow .. segments and absolute paths to escape containment.

Attack Vector

Exploitation requires that a target application extract an attacker-supplied archive using the vulnerable APIs. Common exposure surfaces include file upload handlers, backup restoration tools, plugin or theme installers, CI/CD artifact processors, and email attachment scanners. A single malicious archive can plant files in locations such as user home directories, SSH configuration paths, systemd unit directories, or web application roots. When writes land in an executed location, the traversal escalates to arbitrary code execution under the extracting process's privileges. See the issue tracker discussion for reproduction details.

Detection Methods for CVE-2024-55587

Indicators of Compromise

Files created outside the intended extraction directory following archive processing, particularly in system paths such as /etc, ~/.ssh, or web document roots.
ZIP archives containing entries with names beginning with ../, ..\, or absolute paths such as /etc/passwd.
Unexpected modifications to cron files, systemd units, shell profiles, or startup scripts on hosts that recently processed untrusted archives.

Detection Strategies

Perform software composition analysis to inventory Python projects that import libarchive and pin versions at or below 4.2.1.
Statically scan source code for calls to ZipFile.extractall and ZipFile.extract originating from python-libarchive.
Inspect archive contents before extraction and reject entries whose normalized path escapes the target directory.

Monitoring Recommendations

Enable file integrity monitoring on sensitive directories including /etc, /var/spool/cron, and user .ssh folders.
Log filesystem writes performed by Python interpreters and correlate them with archive processing services.
Alert on process chains where an archive-handling service spawns child processes from files it recently wrote.

How to Mitigate CVE-2024-55587

Immediate Actions Required

Identify all applications and containers that ship or depend on python-libarchive version 4.2.1 or earlier.
Restrict archive extraction workflows to trusted sources until a fixed release is deployed.
Run archive extraction under least-privilege service accounts and inside sandboxed working directories.

Patch Information

At the time of publication, the proposed fix pull request addresses the traversal by validating extracted paths against the destination directory. Consumers should track the upstream repository for a released version that incorporates the fix and update immediately once available. Downstream distributions may backport the patch ahead of an upstream release.

Workarounds

Replace python-libarchive with a maintained archive library that enforces path containment, or wrap extraction calls with explicit path validation using os.path.realpath comparisons against the destination root.
Pre-scan archives and reject any member whose name contains .. segments, backslashes, or leading path separators before invoking extract or extractall.
Execute extraction inside an ephemeral chroot, container, or unprivileged filesystem namespace so that traversal writes cannot reach sensitive host paths.

bash

# Configuration example
# Enumerate installed versions and remove vulnerable python-libarchive
pip show libarchive | grep -E 'Name|Version|Location'
pip uninstall -y libarchive

# Pre-extraction validation guard for callers that must retain the library
python - <<'PY'
import os, zipfile, sys
dest = os.path.realpath(sys.argv[1])
with zipfile.ZipFile(sys.argv[2]) as zf:
    for name in zf.namelist():
        target = os.path.realpath(os.path.join(dest, name))
        if not target.startswith(dest + os.sep):
            raise SystemExit(f'unsafe entry rejected: {name}')
PY