id: GO-2025-3605
modules:
    - module: github.com/mholt/archiver
      vulnerable_at: 2.1.0+incompatible
    - module: github.com/mholt/archiver/v3
      vulnerable_at: 3.5.1
summary: Vulnerable to Path Traversal via Crafted ZIP File in github.com/mholt/archiver
cves:
    - CVE-2025-3445
ghsas:
    - GHSA-7vpp-9cxj-q8gv
references:
    - advisory: https://github.com/advisories/GHSA-7vpp-9cxj-q8gv
    - fix: https://github.com/mholt/archiver/commit/fea250ac6eacd56f90a82fbe2481cfdbb9a1bbd1
    - report: https://github.com/mholt/archiver/issues/267
notes:
    - 'markus: this report came with ''unsupported version 3.5.1'', same as the fixed. is it fixed past 3.5.1?'
source:
    id: GHSA-7vpp-9cxj-q8gv
    created: 2025-07-23T19:56:23.216387277Z
review_status: REVIEWED