Path traversal in ark - CVE-2024-57966

Vulnerability identifier: #VU103730

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-57966

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in libarchiveplugin.cpp. A remote attacker can use a specially crafted archive and install arbitrary files on the system.

ark
Debian Linux
Slackware Linux
openEuler
ark
ark-libs
ark-debugsource
ark-debuginfo
ark (Debian package)

Install updates from vendor's website.

ark - update to 24.12.0
ark - update to 21.12.1
ark-libs - addressed in versions 22.08.3-2, 23.08.4-3
ark-debugsource - addressed in versions 22.08.3-2, 23.08.4-3
ark - addressed in versions 22.08.3-2, 23.08.4-3
ark-debuginfo - addressed in versions 22.08.3-2, 23.08.4-3
ark (Debian package) - update to 4:22.12.3-1+deb12u1

• https://github.com/KDE/ark/commit/fe518d81b338941e0bf1c5ce5e75a9ab6de4bb58
• https://github.com/KDE/ark/compare/v24.11.90...v24.12.0
• https://lists.debian.org/debian-lts-announce/2025/02/msg00007.html

• Path traversal in KDE ark
• openEuler 24.03 LTS update for ark
• openEuler 22.03 LTS SP4 update for ark
• openEuler 22.03 LTS SP3 update for ark
• openEuler 24.03 LTS SP1 update for ark
• Slackware Linux update for ark
• Debian update for ark