{"action":"Upgrade internetarchive to 5.5.1 or later.","affected":[{"fixed":"5.5.1","introduced":"0"}],"component":"internetarchive","cve_ids":["CVE-2025-58438"],"ecosystem":"PyPI","epss":0.01602,"exploited":false,"fixed_versions":["5.5.1"],"ghsa_id":"GHSA-wx3r-v6h7-frjp","id":"tcs_01M5KG31CWJ6S24E3CN60M6M0E","modified_at":"2026-10-27T17:30:37.974244994Z","published_at":"2025-09-05T21:00:42Z","references":["https://osv.dev/vulnerability/GHSA-wx3r-v6h7-frjp","https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp","https://nvd.nist.gov/vuln/detail/CVE-2025-58438","https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2","https://github.com/jjjake/internetarchive","https://github.com/jjjake/internetarchive/releases/tag/v5.5.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00030.html","https://github.com/pypa/advisory-database/tree/main/vulns/internetarchive/PYSEC-2026-357.yaml","https://pypi.org/project/internetarchive"],"severity":{"label":"critical","score":9.4},"sources":[{"source":"osv","source_id":"GHSA-wx3r-v6h7-frjp","url":"https://osv.dev/vulnerability/GHSA-wx3r-v6h7-frjp"},{"source":"nvd","source_id":"CVE-2025-58438","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58438"}],"summary":"internetarchive Vulnerable to Directory Traversal in File.download()"}