CVE-2025-64346: Archives Go Library RCE Vulnerability

CVE-2025-64346 Overview

CVE-2025-64346 is a path traversal vulnerability [CWE-22] in archives, a Go library for extracting archives such as tar and zip. Version 1.0.0 fails to validate entry paths inside archives, allowing a malicious archive to write files outside the intended extraction directory. Attackers can leverage this extract breakout to overwrite arbitrary files on the host, leading to remote code execution, file modification, or other impact in the context of the process importing the library. The maintainer released version 1.0.1 to remediate the issue.

Critical Impact
A crafted archive can escape the extraction directory and overwrite files, enabling code execution scoped to the privileges of the calling application.

Affected Products

github.com/jaredallard/archives version 1.0.0
Go applications importing the vulnerable library for archive extraction
Downstream tooling that processes untrusted tar or zip inputs through this library

Discovery Timeline

2025-11-07 - CVE-2025-64346 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64346

Vulnerability Analysis

The archives library extracts entries from archive containers without sufficiently sanitizing the destination path. When an archive entry contains a relative path with ../ sequences or an absolute path, the extraction routine writes the file to the resolved location rather than confining it beneath the target extraction root. This is a classic Zip Slip style flaw affecting both tar and zip handling.

Because extraction executes with the permissions of the importing process, an attacker who can supply an archive can overwrite configuration files, binaries, systemd units, shell profile scripts, or SSH authorized_keys. Overwriting an executable or scheduled task then produces arbitrary code execution on the next invocation. The severity of exploitation depends on how the calling application accepts and processes archives.

Root Cause

The root cause is missing validation that the joined destination path remains within the extraction root. Safe implementations must resolve the target path using filepath.Clean, reject absolute paths, and verify the result is prefixed by the intended output directory before writing. Version 1.0.0 omits this check, allowing archive entry names to steer writes anywhere the process can reach.

Attack Vector

Exploitation requires that an application built on archives v1.0.0 extract an attacker-controlled archive. Delivery paths include file upload endpoints, package or plugin installers, CI/CD pipelines consuming third-party artifacts, and update mechanisms fetching remote archives. The attacker crafts an archive containing an entry named, for example, ../../../../etc/cron.d/pwn or an absolute path targeting a startup script.

text

// Patch reference from the maintainer's fix commit
// The security fix is tracked as "extract breakout" in the stencil-golang v1.6.0 update.
// See the GitHub Security Advisory GHSA-j95m-rcjp-q69h for the vulnerable code path
// and the commit below for the remediation landing in v1.0.1.

Source: GitHub Security Advisory GHSA-j95m-rcjp-q69h and remediation commit 3bddec7.

Detection Methods for CVE-2025-64346

Indicators of Compromise

Files written outside expected extraction directories after archive processing by a Go application
Archive entries whose names contain ../ sequences, backslash traversal, or absolute paths
Unexpected modifications to sensitive paths such as /etc/cron.d/, ~/.ssh/authorized_keys, systemd unit files, or application binaries following an upload or update event

Detection Strategies

Perform Software Composition Analysis (SCA) against go.sum and go.mod files to flag github.com/jaredallard/archives at version v1.0.0
Inspect archive contents before extraction and alert on entries containing .., absolute path prefixes, or symlinks pointing outside the archive root
Correlate process telemetry from archive-handling services with file writes that occur outside the designated extraction directory

Monitoring Recommendations

Enable file integrity monitoring on system directories, cron paths, service unit files, and user shell profile scripts
Log and audit all invocations of archive extraction routines in application code, including source archive origin and destination path
Alert on new or modified executables created by service accounts that only extract archives as part of normal operation

How to Mitigate CVE-2025-64346

Immediate Actions Required

Upgrade github.com/jaredallard/archives to version 1.0.1 or later across all Go modules that import it
Rebuild and redeploy any binaries statically linked against the vulnerable version
Audit archive extraction workflows that processed untrusted input while running v1.0.0 and inspect target directories for anomalous files

Patch Information

The issue is fixed in version 1.0.1 of github.com/jaredallard/archives. The remediation is described in GitHub Security Advisory GHSA-j95m-rcjp-q69h and landed in commit 3bddec7, which introduces the extract breakout fix alongside a stencil-golang v1.6.0 dependency update.

Workarounds

Restrict extraction to archives from trusted sources until the upgrade is deployed
Run archive-processing services under the least-privileged account possible and in a sandboxed or containerized filesystem with read-only mounts for sensitive paths
Wrap extraction calls with a validator that resolves each entry's destination via filepath.Clean and rejects any path not contained within the target directory

bash

# Update to the patched version in your Go module
go get github.com/jaredallard/archives@v1.0.1
go mod tidy

# Verify the resolved version
go list -m github.com/jaredallard/archives