{"action":"Upgrade internetarchive to 5.5.1 or later.","affected":[{"fixed":"5.5.1","introduced":"0"}],"component":"internetarchive","cve_ids":["CVE-2025-58438"],"ecosystem":"PyPI","epss":0.01602,"exploited":false,"fixed_versions":["5.5.1"],"ghsa_id":"GHSA-wx3r-v6h7-frjp","id":"tcs_01M5KH63CF6TA77GXNY42YYHQR","modified_at":"2026-07-13T16:15:26.900634995Z","published_at":"2026-06-29T11:50:37.387123Z","references":["https://osv.dev/vulnerability/PYSEC-2026-357","https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp","https://nvd.nist.gov/vuln/detail/CVE-2025-58438","https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2","https://github.com/jjjake/internetarchive","https://github.com/jjjake/internetarchive/releases/tag/v5.5.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00030.html","https://pypi.org/project/internetarchive","https://github.com/advisories/GHSA-wx3r-v6h7-frjp"],"severity":{"label":"critical","score":9.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-357","url":"https://osv.dev/vulnerability/PYSEC-2026-357"},{"source":"nvd","source_id":"CVE-2025-58438","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58438"}],"summary":"internetarchive Vulnerable to Directory Traversal in File.download()"}