CVE-2024-42471

Arbitrary File Write via artifact extraction in actions/artifact

CVSS 7.3 HIGHEPSS 3.0%CWE-22

Vexday Risk Score

41Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 7.3EPSS 3.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

02 Sep 2024Published on NVD

24 Apr 2025Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected products

actions · toolkit

public PoCs found — 2

githubgithub.com/theMcSam/CVE-2024-42471-PoC★ 0 exploitdbwww.exploit-db.com/exploits/52276unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/actions/toolkit/pull/1666 https://github.com/actions/toolkit/security/advisories/GHSA-6q32-hq47-5qq3 https://snyk.io/research/zip-slip-vulnerability