CVE-2024-42471

Deeper analysis

CVE-2024-42471 affects the actions/artifact package in the GitHub Actions Toolkit on the 2.x branch prior to version 2.1.2. The flaw is a path traversal issue (CWE-22) that permits arbitrary file writes when the functions downloadArtifactInternal, downloadArtifactPublic, or streamExtractExternal process a specially crafted artifact containing traversal sequences in filenames.

An authenticated attacker who can supply or substitute a malicious artifact can exploit the vulnerability to write files outside the intended extraction directory on the runner or host executing the action. Successful exploitation yields high confidentiality and integrity impact but no availability impact, consistent with the reported CVSS 7.3 score.

The GitHub advisory GHSA-6q32-hq47-5qq3 and the associated pull request direct users to upgrade to actions/artifact 2.1.2 or later; no workarounds are documented. The referenced Snyk research on Zip-Slip provides additional background on the class of extraction vulnerabilities.

EPSS for the CVE rose from a low baseline to a peak of 0.0771, indicating measurable post-disclosure exploitation interest that warrants renewed attention even though current probability sits at 0.0541.