CVE-2025-3445: Path Traversal “Zip Slip” Vulnerability in mholt/archiver

Overview

The cybersecurity landscape is continuously evolving, and new vulnerabilities can emerge at any time. One such vulnerability is the CVE-2025-3445, a Path Traversal “Zip Slip” vulnerability identified in mholt/archiver in Go. This vulnerability is particularly dangerous because it poses potential risks of system compromise or data leakage. It affects any application utilizing the mholt/archiver library and can lead to severe consequences, such as privilege escalation and code execution, if exploited successfully.

Vulnerability Summary

CVE ID: CVE-2025-3445
Severity: High – CVSS Score 8.1
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

mholt/archiver | All versions

How the Exploit Works

The exploit works by using a specially crafted ZIP file that contains path traversal symbolic links (symlinks). When an application using the vulnerable mholt/archiver library unarchives the ZIP file using the archiver.Unarchive function, the malicious ZIP file can be extracted in a way that overwrites sensitive files on the system. The overwritten files are written with the same privileges as the application executing the vulnerable function. This could potentially lead to privilege escalation, code execution, and other serious threats to the system.

Conceptual Example Code

Here’s a conceptual example of how the vulnerability might be exploited. This is an example of a crafted ZIP file that contains a symlink to a sensitive system file:

package main
import (
"github.com/mholt/archiver"
)
func main() {
zipFile := "malicious.zip"  // A ZIP file containing a symlink to /etc/passwd
outputDir := "/tmp"
// Unarchive the ZIP file
err := archiver.Unarchive(zipFile, outputDir)
if err != nil {
log.Fatal(err)
}
}

In this example, if the ‘malicious.zip’ file contains a symlink to a sensitive file (like /etc/passwd), it could overwrite that file when unarchived, potentially leading to privilege escalation.

Mitigation and Remediation

The recommended solution to this vulnerability is to apply the vendor patch when it becomes available. In the meantime, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as temporary mitigation. It’s also advisable to replace the deprecated mholt/archiver project with its successor, mholt/archives, which has removed the Unarchive() functionality in its initial release (v0.1.0).