CVE-2024-42471CWE-22

Arbitrary File Write via artifact extraction in actions/artifact

High · published September 2, 2024

CVSS v3.1
7.3
EPSS
3%
Percentile
88.1
In the wild
Unconfirmed
What it is

actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.03219 · 88.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-09-02T16:13Z
EPSS history
Timeline
  • 02 SEP 16:13Z
    Arbitrary File Write via artifact extraction in actions/artifact
    cvelistv5