{"id":"CVE-2024-55587","aliases":["GHSA-75mx-hw5q-pvx3","PYSEC-2026-1848"],"title":"python-libarchive directory traversal","summary":"python-libarchive directory traversal","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"python-libarchive","product":"python-libarchive","ecosystem":"pip","affected":["python-libarchive <= 4.2.1"],"published":"2024-12-12","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-75mx-hw5q-pvx3","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55587"},{"url":"https://github.com/smartfile/python-libarchive/issues/42"},{"url":"https://github.com/smartfile/python-libarchive/pull/41"},{"url":"https://github.com/smartfile/python-libarchive"},{"url":"https://github.com/smartfile/python-libarchive/blob/c7677411bfc4ab5701d343bc6ebd9e35c990e80e/libarchive/zip.py#L107"}],"tags":["osv","pip","exploit-available"],"epss":0.021,"epssPercentile":0.80889,"ingestedAt":"2026-07-08T18:25:46.778Z","exploits":{"github":1,"githubRepos":["https://github.com/CSIRTTrizna/CVE-2024-55587"],"checkedAt":"2026-09-23T07:13:30.673Z"},"exploitAvailable":true,"slug":"CVE-2024-55587","body":"## Overview\n\npython-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract.\n\n## Affected packages\n\n- `python-libarchive <= 4.2.1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":4741,"id":"CVE-2024-55587","ts":1788887203294,"field":"exploit_available","old":"false","new":"true"},{"seq":3624,"id":"CVE-2024-55587","ts":1788886319466,"field":"exploit_available","old":"true","new":"false"},{"seq":2478,"id":"CVE-2024-55587","ts":1788882988011,"field":"exploit_available","old":"false","new":"true"},{"seq":1507,"id":"CVE-2024-55587","ts":1788882401577,"field":"exploit_available","old":"true","new":"false"},{"seq":621,"id":"CVE-2024-55587","ts":1788881838244,"field":"exploit_available","old":"false","new":"true"}]}