CVE-2024-0406

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
—	—	>= v3.0.0, < *
Red Hat	Red Hat OpenShift Container Platform 4.18	—
Red Hat	Red Hat Advanced Cluster Security 3	—
Red Hat	Red Hat Advanced Cluster Security 3	—
Red Hat	Red Hat Advanced Cluster Security 3	—
Red Hat	Red Hat Advanced Cluster Security 4	—
Red Hat	Red Hat Advanced Cluster Security 4	—
Red Hat	Red Hat Advanced Cluster Security 4	—

References

https://access.redhat.com/errata/RHSA-2025:2449Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-0406Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2257749Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-0406Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2257749Third Party Advisory

Timeline

Published: Apr 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-04076.5Certain HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to information disclosure, when connections made CVE-2024-04085.5A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When CVE-2024-04097.8A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cu CVE-2024-04107.7An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior CVE-2024-04117.5A vulnerability was found in DeShang DSMall up to 6.1.0. It has been classified as problematic. This affects an unknown part of the file pub CVE-2024-04129.8A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the CVE-2024-04139.8A vulnerability was found in DeShang DSKMS up to 3.1.2. It has been rated as problematic. This issue affects some unknown processing of the CVE-2024-04149.8A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file publi CVE-2024-04159.8A vulnerability classified as critical was found in DeShang DSMall up to 6.1.0. Affected by this vulnerability is an unknown functionality o CVE-2024-04169.8A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown func CVE-2024-04179.8A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file applica CVE-2024-04187.5A vulnerability has been found in iSharer and upRedSun File Sharing Wizard up to 1.5.0 and classified as problematic. This vulnerability aff