github.com/mholt/archiver (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/mholt/archiver, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2025-3445 — CVSS 8.1 (high): A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file…
• CVE-2024-0406 — CVSS 6.1 (medium): A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when…
• CVE-2018-1002207 — CVSS 5.5 (medium): mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to…
• CVE-2019-10743 — CVSS 5.5 (medium): All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. It is exploited using a specially…