Fuse Archive
Monthly
Local code execution in Google fuse-archive versions prior to 1.24 lets an attacker hijack the external decompression helpers that libarchive launches when an archive is mounted, by prepending a directory to the process PATH or by planting a malicious binary in an attacker-writable directory that already appears on PATH. The flaw is an untrusted search path issue (CWE-426) rated 5.4 under CVSS 4.0 (AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H); exploitation requires local access as an authenticated user (PR:L), that fuse-archive run without the '-o noexternal' option, and that a victim mount an archive whose format triggers an external filter such as base64 or gpg. No public exploit code or CISA KEV entry was identified at time of analysis; version 1.22 delivered only a partial mitigation and version 1.24 fully resolves the issue by restricting external helper lookups to a sanitized, fixed PATH.
Local code execution in Google fuse-archive versions prior to 1.24 lets an attacker hijack the external decompression helpers that libarchive launches when an archive is mounted, by prepending a directory to the process PATH or by planting a malicious binary in an attacker-writable directory that already appears on PATH. The flaw is an untrusted search path issue (CWE-426) rated 5.4 under CVSS 4.0 (AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H); exploitation requires local access as an authenticated user (PR:L), that fuse-archive run without the '-o noexternal' option, and that a victim mount an archive whose format triggers an external filter such as base64 or gpg. No public exploit code or CISA KEV entry was identified at time of analysis; version 1.22 delivered only a partial mitigation and version 1.24 fully resolves the issue by restricting external helper lookups to a sanitized, fixed PATH.