CVE-2024-57966 Path traversal in ark
Attackers can extract archives to arbitrary absolute paths, potentially overwriting critical files on the victim's system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-57966?
CVE-2024-57966 is a medium-severity path traversal vulnerability in KDE ark, published on 3 Feb 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.
Weakness: CWE-36
Which versions are affected by CVE-2024-57966?
Linux distribution packages (2)
ark SUSE:Package Hub 15 SP6 | All versions | 23.08.5-bp156.2.3.1 |
ark openSUSE:Leap 15.6 | All versions | 23.08.5-bp156.2.3.1 |
How do I fix CVE-2024-57966?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-57966 being exploited?
There is no known exploitation of CVE-2024-57966 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-57966, DLA-4046-1, DSA-6029-1, GHSA-v9cx-qp5g-qchc, MGASA-2025-0061, OESA-2025-1130 and 5 more.