Description
actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue.
Published: 2024-09-02
Score: 7.3 High
EPSS: 7.7% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-2737 actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue.
Github GHSA Github GHSA GHSA-6q32-hq47-5qq3 @actions/artifact has an Arbitrary File Write via artifact extraction
History

Wed, 27 Aug 2025 22:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:actions\/artifact\/:github_toolkit:*:*:*:*:*:*:*:*
Vendors & Products Actions\/artifact\/
Actions\/artifact\/ github Toolkit

Thu, 23 Jan 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jan 2025 17:30:00 +0000

Type Values Removed Values Added
References

Wed, 22 Jan 2025 16:45:00 +0000

Type Values Removed Values Added
Description actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.7 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.7 or higher. There are no known workarounds for this issue. actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue.
References

Wed, 22 Jan 2025 15:30:00 +0000

Type Values Removed Values Added
Description actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` before 2.1.7 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.7 or higher. There are no known workarounds for this issue. actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.7 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.7 or higher. There are no known workarounds for this issue.

Mon, 16 Sep 2024 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Github
Github actions\/artifact
Github actions Toolkit
CPEs cpe:2.3:a:github:actions\/artifact:*:*:*:*:*:node.js:*:*
cpe:2.3:a:github:actions_toolkit:-:*:*:*:*:*:*:*
Vendors & Products Github
Github actions\/artifact
Github actions Toolkit

Tue, 03 Sep 2024 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Actions\/artifact\/
Actions\/artifact\/ github Toolkit
CPEs cpe:2.3:a:actions\/artifact\/:github_toolkit:*:*:*:*:*:*:*:*
Vendors & Products Actions\/artifact\/
Actions\/artifact\/ github Toolkit
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 02 Sep 2024 16:30:00 +0000

Type Values Removed Values Added
Description actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` before 2.1.7 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.7 or higher. There are no known workarounds for this issue.
Title Arbitrary File Write via artifact extraction in actions/artifact
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'}

Subscriptions

Github Actions\/artifact Actions Toolkit
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-08-27T21:33:03.045Z

Reserved: 2024-08-02T14:13:04.615Z

Link: CVE-2024-42471

cve-icon Vulnrichment

Updated: 2024-09-03T14:11:11.507Z

cve-icon NVD

Status : Modified

Published: 2024-09-02T18:15:35.540

Modified: 2025-08-27T22:15:44.070

Link: CVE-2024-42471

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses