CVE-2024-0406 is a path traversal flaw in the mholt/archiver Go package, scored CVSS 6.1 (medium) in the record. A crafted tar file can make an unpack write or overwrite files outside the target folder. No fixed upstream version is confirmed here, so check your vendor errata.
What's affected
The record names the mholt/archiver package and, as downstream products, Red Hat Advanced Cluster Security and Red Hat OpenShift Container Platform. Red Hat's CVE page says the flaw is in version 3 of mholt/archiver.
The record does not give a fixed version of the library. Red Hat's page lists a Bugzilla entry and the record links the erratum RHSA-2025:2449, so Red Hat customers should read that erratum for the fixed product build. We did not load the erratum itself.
The weakness is CWE-22. The record's vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N, which gives 6.1 (medium).
Source conflict worth knowing: Red Hat's score breakdown on its CVE page shows its own base score of 6.1 and an NVD score of 7.8, and Red Hat rates the flaw Moderate. The record we hold lists 6.1. Depending on which list you read, this is medium or high on the CVSS scale. Red Hat's reasoning is that exploitation needs local file system or code execution level access and only overwrites files, with no code execution or resource exhaustion.
It is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
For Go projects, check whether the module is in your dependency graph:
go list -m all | grep mholt/archiver
go mod why -m github.com/mholt/archiver/v3
The first command lists the module and version when present. The second shows which of your packages pulls it in. Search vendored directories too.
Then look at how it is used. The risk sits where your code unpacks a tar file you did not create. If you only create archives, or only unpack your own, the exposure is much lower. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest and lists known issues, and reachability analysis helps decide whether the unpack code is actually called.
For Red Hat products, use the vendor erratum rather than the library version.
What to do now
- Find every service and tool that depends on mholt/archiver, directly or through a transitive dependency.
- For Red Hat products, apply the fixed build in the erratum for your version.
- Where you control the code, stop unpacking untrusted tar files with this library until you have a fix, or check every entry path and refuse any that would land outside the target folder.
- Run extraction in a throwaway directory as an account with minimal write rights.
- Check the project page for current status, since we could not confirm a fixed upstream release.
Why it matters
Archive extraction is a classic source of path traversal bugs. A tar entry carries its own path, and an unpacker that trusts it can write outside the destination. The library runs with your application's privileges, so overwritten files are files that application can write.
Reasonable people can rate this one medium or high depending on how the library is used, which is why the reachability question matters more than the number.
Quick check
Is CVE-2024-0406 exploitable over the network by itself?
Not by itself. The vector is local and needs user interaction. Red Hat says exploitation needs local file system or code execution level access.
What is the fixed version of mholt/archiver?
We could not confirm one from the sources we read. Check the project and, for Red Hat products, the referenced erratum.
Sources
Last reviewed: 19 October 2026.
