Security readout for executives and security teams
Plain-English summary
This flaw affects Go software using Cloud Foundry's archiver extractor to unpack archives. A malicious archive can place files outside the intended extraction folder, potentially overwriting important files. Business risk is highest where the application accepts archives from users, partners, build pipelines, or automated integrations.
Executive priority
Prioritize remediation for internet-facing upload services, partner ingestion systems, CI pipelines, and automation that extracts archives. If the dependency is present but only used with trusted internal archives, urgency remains high but exposure is narrower.
Technical view
CVE-2018-25046 is a path traversal issue in code.cloudfoundry.org/archiver/extractor caused by improper path sanitization during archive extraction. The CVSS 3.1 score is 9.1 because exploitation can be remote, unauthenticated, low complexity, and can cause high integrity and availability impact, with no confidentiality impact stated.
Likely exposure
Exposure is likely limited to Go applications that import code.cloudfoundry.org/archiver/extractor and extract untrusted or externally supplied archives. The bundle does not support treating all Cloud Foundry deployments as affected; validate actual dependency use and archive ingestion paths.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The vulnerability class aligns with Zip Slip-style archive traversal, which is well understood and dangerous when archive contents are trusted during extraction.
Researcher notes
Affected version data in the bundle is sparse, listing package version 0. Treat dependency resolution carefully and rely on the Go advisory plus the Cloud Foundry fix reference. Do not infer broader product impact without confirming import paths and reachable extraction behavior.
Mitigation direction
- Inventory Go services for code.cloudfoundry.org/archiver/extractor usage.
- Review the Go vulnerability advisory and Cloud Foundry commit for fixed revision guidance.
- Update affected dependencies where vendor guidance identifies a safe version or revision.
- Restrict archive extraction to trusted sources until fixed.
- Harden extraction logic to reject paths escaping the target directory.
- Monitor for unexpected file writes near archive processing workflows.
Validation and detection
- Check go.mod and go.sum for the affected archiver module.
- Identify routes, jobs, or pipelines that process uploaded or external archives.
- Confirm extracted files cannot resolve outside the intended destination directory.
- Review logs and filesystem telemetry for suspicious overwrite activity.
- Add regression tests covering archive path sanitization behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
File access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-25046 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H3.95.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/cloudfoundry/archiver/commit/09b5706aa9367972c09144a450bb4523049ee840CVE reference
- https://snyk.io/research/zip-slip-vulnerabilityCVE reference
- https://pkg.go.dev/vuln/GO-2020-0025CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.