# GHSA-cxww-7g56-2vh6: @actions/download-artifact has an Arbitrary File Write via artifact extraction

> GHSA-cxww-7g56-2vh6 is a high-severity vulnerability with a CVSS 4.0 base score of 8.6, classed as Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22), in actions/download-artifact (GitHub Actions). Affected versions: >= 4.0.0, < 4.1.3. It is fixed in 4.1.3.

Canonical page: https://cveminer.com/vulnerabilities/GHSA-cxww-7g56-2vh6

| Field | Value |
| --- | --- |
| GHSA | GHSA-cxww-7g56-2vh6 |
| Severity | High |
| CVSS 4.0 | 8.6 `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N` (GitHub Advisory Database) |
| CVSS 3.1 | 7.3 `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N` (GitHub Advisory Database) |
| CWE | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| CISA KEV | Not listed |
| Published | 3 Sept 2024 |
| Modified | 22 Jan 2025 |

## Description

##### Impact

Versions of `actions/download-artifact` before 4.1.3 are vulnerable to arbitrary file write when downloading and extracting a specifically crafted artifact that contains path traversal filenames.

##### Patches

Upgrade to version 4.1.3 or higher. Alternatively use 'v4' tag which points to the latest and secure version.

##### References

- https://snyk.io/research/zip-slip-vulnerability
- https://github.com/actions/download-artifact/releases/tag/v4.1.3
- https://github.com/actions/download-artifact/pull/299

##### CVE

CVE-2024-42471

##### Credits

Justin Taft from Google

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| actions/download-artifact | GitHub Actions | `pkg:github/actions/download-artifact` | >= 4.0.0, < 4.1.3 | 4.1.3 |

## Questions

**Does GHSA-cxww-7g56-2vh6 have a CVE ID?**

No CVE ID has been assigned to GHSA-cxww-7g56-2vh6 yet. It is tracked only as a GitHub advisory.

**What is the CVSS score of GHSA-cxww-7g56-2vh6?**

GHSA-cxww-7g56-2vh6 has a CVSS 4.0 base score of 8.6 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Other published scores: CVSS 3.1 7.3.

**Which versions are affected by GHSA-cxww-7g56-2vh6?**

actions/download-artifact (GitHub Actions): >= 4.0.0, < 4.1.3.

**How do I fix GHSA-cxww-7g56-2vh6?**

Upgrade to 4.1.3 or later.

**What is the Package URL (PURL) for GHSA-cxww-7g56-2vh6?**

The affected package's PURL is pkg:github/actions/download-artifact.

## References

- https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6 (advisory)
- https://github.com/advisories/GHSA-6q32-hq47-5qq3 (advisory)
- https://github.com/advisories/GHSA-cxww-7g56-2vh6 (advisory)
- https://github.com/actions/download-artifact (package)
- https://github.com/actions/download-artifact/releases/tag/v4.1.3
- https://snyk.io/research/zip-slip-vulnerability

---

Source: CVEminer (https://cveminer.com/vulnerabilities/GHSA-cxww-7g56-2vh6), compiled from OSV (GitHub advisory), GitHub Advisory Database. OSV and GitHub Advisory Database content is licensed CC BY 4.0.