What is GHSA-q3rp-vvm7-j8jg?

GHSA-q3rp-vvm7-j8jg is a security advisory published by GitHub Security Advisories with Medium severity. Safearchive Path Traversal vulnerability

Which CVE IDs does GHSA-q3rp-vvm7-j8jg cover?

GHSA-q3rp-vvm7-j8jg covers the following CVE IDs: CVE-2024-10389. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q3rp-vvm7-j8jg?

GHSA-q3rp-vvm7-j8jg has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-q3rp-vvm7-j8jg?

GHSA-q3rp-vvm7-j8jg affects 1 product, including: go/github.com/google/safearchive:\u003c 0.0.0-20241025131057-f7ce9d7b6f9c.

GHSA-q3rp-vvm7-j8jgMediumCVSS 5.3

Safearchive Path Traversal vulnerability

Vendor

GitHub Security Advisories

Published

November 4, 2024

Last Modified

July 23, 2025

🔗 CVE IDs covered (1)

CVE-2024-10389 →

📋 Description

There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc

🎯 Affected products1

go/github.com/google/safearchive:< 0.0.0-20241025131057-f7ce9d7b6f9c

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-10389
https://github.com/google/safearchive/commit/f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc
https://github.com/advisories/GHSA-q3rp-vvm7-j8jg