StackRadar

CVE-2025-3445

High

Advisory

Published 14 Apr 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
30
of 17,781 indexed, latest versions
Container images
27
deployed by those charts
Fix available
None
affected packages

mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File

Carried by container images the latest versions of 30 of 17,781 indexed charts deploy, on 27 images.

Affected packageAffected versionsFixed inImages
github.com/mholt/archiver/v3golangv3.3.0, v3.5.0, v3.5.1no fix listed21
github.com/mholt/archivergolangv0.0.0-20180417220235-e4ef56d48eb0, v3.1.1+incompatibleno fix listed6
OSV records
GHSA-7vpp-9cxj-q8gv
Also known as
GO-2025-3605

Charts affected

30 by stars
ChartLatestAffected imagesRadar Score
filebrowserutkuozdemirVerified publisher1.0.01 of 1See more

filebrowser utkuozdemir 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.23.086e8449ff8ff
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

3,073
lndfold0.3.151 of 4See more

lnd fold 0.3.15

1 of the 4 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
thesisrobot/lnd:v0.16.4-beta-c287129953689
github.com/mholt/archiver/v3@v3.5.0
no fix listed

Open the chart page →

8,835
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

3,997
mattermostphntom3.24.01 of 2See more

mattermost phntom 3.24.0

1 of the 2 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

8,722
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

3,793
sn-platformstreamnative1.11.441 of 9See more

sn-platform streamnative 1.11.44

1 of the 9 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
streamnative/pulsar_vault_init:v1.0.731533fa9fab7
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

15,477
fission-corefission-chartsVerified publisher1.14.11 of 3See more

fission-core fission-charts 1.14.1

1 of the 3 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
fission/fission-bundle:1.14.13fcfd8a0fa5d
github.com/mholt/archiver@v0.0.0-20180417220235-e4ef56d48eb0
no fix listed

Open the chart page →

7,104
filebrowsergeek-cookbookVerified publisher1.4.21 of 1See more

filebrowser geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.18.04fcd47af573c
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed

Open the chart page →

3,474
operatoristio1.10.31 of 1See more

operator istio 1.10.3

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
istio/operator:1.10.3655eefa11c84
github.com/mholt/archiver/v3@v3.5.0
no fix listed

Open the chart page →

10,701
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

28,131
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

13,459
cp4d-deployercloud-native-toolkit1.0.01 of 1See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

25,151
electric-mailcryptexlabsVerified publisher0.0.11 of 5See more

electric-mail cryptexlabs 0.0.1

1 of the 5 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.34db614d40d0e
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed

Open the chart page →

5,973
purple-piecryptexlabsVerified publisher0.0.11 of 4See more

purple-pie cryptexlabs 0.0.1

1 of the 4 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.34db614d40d0e
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed

Open the chart page →

5,973
gickupdamounVerified publisher1.11.01 of 1See more

gickup damoun 1.11.0

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
buddyspencer/gickup:0.10.309e7dbf923c12
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

1,028
ambassador-operatordatawire0.3.01 of 1See more

ambassador-operator datawire 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
datawire/ambassador-operator:v1.3.0f95ae710d75c
github.com/mholt/archiver/v3@v3.3.0
no fix listed

Open the chart page →

7,486
furan2dollarshaveclubVerified publisher0.2.01 of 1See more

furan2 dollarshaveclub 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
dollarshaveclub/furan2:master14a257836529
github.com/mholt/archiver/v3@v3.3.0
no fix listed

Open the chart page →

3,046
evi-vaultintelVerified publisher3.0.31 of 2See more

evi-vault intel 3.0.3

1 of the 2 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
hashicorp/vault:1.12.18de4d5f31b38
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

4,478
vaultintelVerified publisher0.8.11 of 2See more

vault intel 0.8.1

1 of the 2 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
hashicorp/vault:1.12.18de4d5f31b38
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

4,478
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

3,999
vaultjfrog0.25.01 of 2See more

vault jfrog 0.25.0

1 of the 2 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
hashicorp/vault:1.14.0b2177a8bfe85
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

3,968
pipecdkrzwiatrzyk0.39.01 of 3See more

pipecd krzwiatrzyk 0.39.0

1 of the 3 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed

Open the chart page →

3,812
kubeclaritykubeclarity2.23.32 of 5See more

kubeclarity kubeclarity 2.23.3

2 of the 5 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/mholt/archiver/v3@v3.5.1
no fix listed
ghcr.io/openclarity/kubeclarity:v2.23.314450f52a708
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

5,496
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

3,430
vault-helm-chartnotesprojectchart0.1.01 of 1See more

vault-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
library/vault:1.13.3f98ac9dd97b0
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

2,246
giteanovum-rgi-charts2.1.31 of 3See more

gitea novum-rgi-charts 2.1.3

1 of the 3 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
gitea/gitea:1.13.0d5ab14cd29af
github.com/mholt/archiver/v3@v3.3.0
no fix listed

Open the chart page →

4,861
prestashopstack-prestahop22.0.01 of 4See more

prestashop stack-prestahop 22.0.0

1 of the 4 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.23.086e8449ff8ff
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

3,073
vaultstakaterVerified publisher0.8.41 of 2See more

vault stakater 0.8.4

1 of the 2 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.4dfc3500beb0e
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed

Open the chart page →

5,864
filebrowserwenerme1.0.01 of 1See more

filebrowser wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.13.0c5d0a75a0041
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed

Open the chart page →

3,174
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2025-3445.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/mholt/archiver/v3@v3.5.1
no fix listed

Open the chart page →

14,983

Container images carrying it

27 by charts deploying them

A fixed version is listed for 0 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
filebrowser/filebrowser:v2.23.086e8449ff8ff
github.com/mholt/archiver/v3@v3.5.1
no fix listed
2
hashicorp/vault:1.8.34db614d40d0e
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed
2
hashicorp/vault:1.15.26b4e5dadf082
github.com/mholt/archiver/v3@v3.5.1
no fix listed
2
hashicorp/vault:1.12.18de4d5f31b38
github.com/mholt/archiver/v3@v3.5.1
no fix listed
2
buddyspencer/gickup:0.10.309e7dbf923c12
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
datadog/agent:6aad9994de6a7
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
datawire/ambassador-operator:v1.3.0f95ae710d75c
github.com/mholt/archiver/v3@v3.3.0
no fix listed
1
dollarshaveclub/furan2:master14a257836529
github.com/mholt/archiver/v3@v3.3.0
no fix listed
1
filebrowser/filebrowser:v2.18.04fcd47af573c
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed
1
filebrowser/filebrowser:v2.13.0c5d0a75a0041
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed
1
fission/fission-bundle:1.14.13fcfd8a0fa5d
github.com/mholt/archiver@v0.0.0-20180417220235-e4ef56d48eb0
no fix listed
1
gitea/gitea:1.21.6ac73e0da341f
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
gitea/gitea:1.13.0d5ab14cd29af
github.com/mholt/archiver/v3@v3.3.0
no fix listed
1
hashicorp/vault:1.15.40b01ed3924e6
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
hashicorp/vault:1.14.0b2177a8bfe85
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
hashicorp/vault:1.8.4dfc3500beb0e
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed
1
istio/operator:1.10.3655eefa11c84
github.com/mholt/archiver/v3@v3.5.0
no fix listed
1
library/vault:1.13.3f98ac9dd97b0
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
streamnative/pulsar_vault_init:v1.0.731533fa9fab7
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
thesisrobot/lnd:v0.16.4-beta-c287129953689
github.com/mholt/archiver/v3@v3.5.0
no fix listed
1
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
ghcr.io/openclarity/kubeclarity:v2.23.314450f52a708
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/mholt/archiver@v3.1.1+incompatible
no fix listed
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/mholt/archiver/v3@v3.5.1
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.