CVE-2025-58438: internetarchive Vulnerable to Directory Traversal in File.download()

What kind of vulnerability is it? This is a Critical severity directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library.

Who is impacted? All users of the internetarchive library versions < 5.5.1 are impacted. The vulnerability is particularly critical for users on Windows systems, but all operating systems are affected.

Description of the vulnerability: The vulnerability existed because the file.download() method did not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., ../../../../windows/system32/file.txt) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory.

Potential Impact: An attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used.