Path Traversal in Jjjake Internetarchive
CVE-2025-58438
internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library. The file.download() method does not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., ../../../../windows/system32/file.txt) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory. An attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used. The vulnerability is particularly critical for users on Windows systems, but all operating systems are affected. This issue is fixed in version 5.5.1.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
EPSS exploit prediction
EPSS: 0.015 (73.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 73.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: +0.000
Affected products
- Jjjake Internetarchive — versions < 5.5.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-58438?
- CVE-2025-58438 is a vulnerability in Jjjake Internetarchive, classified under Path Traversal. Published 2025-09-06.
- Is CVE-2025-58438 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.