HSEC-2026-0014

See a problem?
Import Source
https://github.com/haskell/security-advisories/blob/generated/osv-export/2026/HSEC-2026-0014.json
JSON Data
https://api.osv.dev/v1/vulns/HSEC-2026-0014
Published
2026-11-13T11:01:54Z
Modified
2026-11-13T11:15:03Z
Summary
Arbitrary file write via path traversal in unpackToDir
Details

Arbitrary file write via path traversal in unpackToDir

Codec.Archive.unpackToDir extracts a tar (or other archive supported by the libarchive C library) from a ByteString into a directory. unpackToDirLazy is the streaming variant; both funnel through the same internal unpackEntriesFp routine.

unpackEntriesFp joined each entry's name onto the destination directory with System.FilePath.(</>) without validating the name. Entry names starting with .. sequences therefore escape the destination: fp </> "../../../../etc/x" resolves outside the extraction root. The joined path is written back into the archive entry (archiveEntrySetPathname) and handed to libarchive's archive_read_extract with no ARCHIVE_EXTRACT_SECURE_* flags, so neither the Haskell layer nor the C library rejects the traversal. The .. check is not limited to tar archives: any format whose entry names libarchive reports verbatim is affected. Extraction result codes were also discarded, so write failures could pass unnoticed.

An attacker who can supply an archive to a service that extracts it with these APIs gains an arbitrary file write with the privileges of the extracting process. A demonstrated escalation (verified in a container): an archive with member ../../../../etc/profile.d/zz-poc-zipslip.sh plants a shell script sourced by every subsequent login shell, converting the file write into code execution when any user logs in.

The reported traversal is fixed in libarchive-3.0.6.0, which fails with ArchiveFatal when an entry path begins with .. (commit 325a2296379905557de1fa21b28d86f34bab2441).

Users should upgrade to libarchive-3.0.6.0 or later. If pinned to an older version, validate entry names before extraction (reject absolute paths and any path containing a .. component) or extract inside a sandboxed directory.

External vulnerability reported by Akash Sebastian (justabughunter).

Database specific 
{
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
}
References

Affected packages

Hackage / libarchive

Package

Name
libarchive
Purl
pkg:hackage/libarchive

Severity

  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.1.0.0
Fixed
3.0.6.0

Affected versions

0.*
0.1.0.0
0.2.0.0
0.2.1.0
0.2.1.1
0.2.1.2
1.*
1.0.0.0
1.0.1.0
1.0.2.0
1.0.3.0
1.0.4.0
1.0.5.0
1.0.5.1
2.*
2.0.0.0
2.0.0.1
2.0.0.2
2.1.0.0
2.1.0.1
2.1.1.0
2.1.2.0
2.1.2.1
2.1.3.0
2.1.3.1
2.1.3.2
2.2.0.0
2.2.0.1
2.2.0.2
2.2.1.0
2.2.2.0
2.2.3.0
2.2.4.0
2.2.5.0
2.2.5.1
2.2.5.2
3.*
3.0.0.0
3.0.1.1
3.0.2.0
3.0.2.1
3.0.2.2
3.0.3.0
3.0.3.1
3.0.3.2
3.0.4.1
3.0.4.2
3.0.5.0

Ecosystem specific 

{
    "affected_api": [
        {
            "module": "Codec.Archive",
            "name": "unpackToDir"
        },
        {
            "module": "Codec.Archive",
            "name": "unpackToDirLazy"
        },
        {
            "module": "Codec.Archive",
            "name": "unpackArchive"
        }
    ]
}

Database specific

human_link 
"https://github.com/haskell/security-advisories/tree/main/advisories/published/2026/HSEC-2026-0014.md"
osv 
"https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2026/HSEC-2026-0014.json"
source 
"https://github.com/haskell/security-advisories/blob/generated/osv-export/2026/HSEC-2026-0014.json"