@actions/download-artifact has an Arbitrary File Write via artifact extraction
GHSA-cxww-7g56-2vh6 is a high-severity vulnerability with a CVSS 4.0 base score of 8.6, classed as Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22), in actions/download-artifact (GitHub Actions). Affected versions: >= 4.0.0, < 4.1.3. It is fixed in 4.1.3.
Published 3 Sept 2024Updated 22 Jan 2025
- CVE ID
- No CVE assigned
- GHSA ID
- GHSA-cxww-7g56-2vh6
- EPSS
- Not scored
- Weakness (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- KEV status
- Not in KEV
- Published
- 3 Sept 2024
- Updated
- 22 Jan 2025
- Ecosystem
- GitHub Actions
Summary
Source: OSV (GitHub advisory)
Impact
Versions of actions/download-artifact before 4.1.3 are vulnerable to arbitrary file write when downloading and extracting a specifically crafted artifact that contains path traversal filenames.
Patches
Upgrade to version 4.1.3 or higher. Alternatively use 'v4' tag which points to the latest and secure version.
References
- https://snyk.io/research/zip-slip-vulnerability
- https://github.com/actions/download-artifact/releases/tag/v4.1.3
- https://github.com/actions/download-artifact/pull/299
CVE
CVE-2024-42471
Credits
Justin Taft from Google
Technical details
Source: GitHub Advisory Database
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NHigh8.6Base score from GitHub Advisory Database
- Attack Vector AV
- Network
- Attack Complexity AC
- Low
- Attack Requirements AT
- None
- Privileges Required PR
- Low
- User Interaction UI
- None
- Confidentiality (Vulnerable System) VC
- High
- Integrity (Vulnerable System) VI
- High
- Availability (Vulnerable System) VA
- None
- Confidentiality (Subsequent Systems) SC
- None
- Integrity (Subsequent Systems) SI
- None
- Availability (Subsequent Systems) SA
- None
Affected packages
Source: OSV (GitHub advisory)
- actions/download-artifactGitHub Actions
pkg:github/actions/download-artifact- Affected versions
- >= 4.0.0, < 4.1.3
- Fixed in
- 4.1.3
| Package | Affected versions | Fixed in |
|---|---|---|
actions/download-artifact GitHub Actions pkg:github/actions/download-artifact |
|
|
Fix
Source: OSV (GitHub advisory)
Fix available
Upgrade to 4.1.3 or later.
Vulnerability intelligence
Root cause analysis
Vulnerable functions
References
Advisories 3
Package 1
Credits
- holmanbanalyst
Questions about GHSA-cxww-7g56-2vh6
- Does GHSA-cxww-7g56-2vh6 have a CVE ID?
- No CVE ID has been assigned to GHSA-cxww-7g56-2vh6 yet. It is tracked only as a GitHub advisory.
- What is the CVSS score of GHSA-cxww-7g56-2vh6?
- GHSA-cxww-7g56-2vh6 has a CVSS 4.0 base score of 8.6 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Other published scores: CVSS 3.1 7.3.
- Which versions are affected by GHSA-cxww-7g56-2vh6?
- actions/download-artifact (GitHub Actions): >= 4.0.0, < 4.1.3.
- How do I fix GHSA-cxww-7g56-2vh6?
- Upgrade to 4.1.3 or later.
- What is the Package URL (PURL) for GHSA-cxww-7g56-2vh6?
- The affected package's PURL is pkg:github/actions/download-artifact.
Data sources
Upstream records
Fetched 6 days ago (8 Oct 2026, 11:03 UTC). Records refresh automatically after 24 hours.
Where each part of this page came from
- Title and description
- OSV (GitHub advisory)
- Severity score
- GitHub Advisory Database
- Weakness (CWE)
- GitHub Advisory Database
- Affected packages
- OSV (GitHub advisory)
- Fix
- OSV (GitHub advisory)
- References
- Computed by CVEminer
OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.