PyPI/internetarchive CVE-2025-58438: critical 9.4, EPSS 1.59%
internetarchive Vulnerable to Directory Traversal in File.download()
Action: Upgrade internetarchive to 5.5.1 or later.
pip install internetarchive==5.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.5.1 | - |
Fixed versions
| 5.5.1 |
Sources
- osv: PYSEC-2026-357
- nvd: CVE-2025-58438
- https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp
- https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2
- https://github.com/jjjake/internetarchive
- https://github.com/jjjake/internetarchive/releases/tag/v5.5.1
- https://lists.debian.org/debian-lts-announce/2025/09/msg00030.html
- https://pypi.org/project/internetarchive
- https://github.com/advisories/GHSA-wx3r-v6h7-frjp
CVE-2025-58438 · published · modified · JSON