CVE-2004-0235: Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create ar...

Security readout for executives and security teams

CVE-2004-0235 is a directory traversal flaw in LHA 1.14. A crafted LHA archive can cause files to be written outside the intended extraction folder, including through parent-directory references or double-slash absolute paths. The main business risk is legacy archive processing that handles untrusted files, especially with elevated privileges. Exposure is most likely on legacy Unix/Linux systems, appliances, build pipelines, or archival workflows that still install LHA 1.14 or process LHA archives from users, partners, email, or repositories. Modern environments are less likely exposed unless they retain old packages or compatibility tooling. Treat this as a legacy-exposure cleanup item unless LHA is used in an automated or privileged archive-processing path. Prioritize remediation higher where external users can submit archives or where extraction occurs as root, in build infrastructure, or on shared servers. Mitigation focus: Inventory systems and workflows that install or invoke LHA.; Update LHA packages using the relevant vendor advisory guidance.; Avoid processing untrusted LHA archives on sensitive or privileged systems..

Prepared

Jun 30, 2026, 05:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.