CVE-2023-30571

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.

• CWE-362
• CWE-362

• https://github.com/libarchive/libarchive/issues/1876Issue Tracking
• https://groups.google.com/g/libarchive-announceRelease Notes
• https://github.com/libarchive/libarchive/issues/1876Issue Tracking
• https://groups.google.com/g/libarchive-announceRelease Notes

Published

May 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30562A GRE dataset file within Systems Manager can be tampered wi…6.7
• CVE-2023-30563A malicious file could be uploaded into a System Manager Use…8.2
• CVE-2023-30564Alaris Systems Manager does not perform input validation dur…6.9
• CVE-2023-30565An insecure connection between Systems Manager and CQI Repor…3.5
• CVE-2023-3057A vulnerability was found in YFCMF up to 3.0.4. It has been …9.8
• CVE-2023-30570pluto in Libreswan before 4.11 allows a denial of service (r…7.5
• CVE-2023-30575Apache Guacamole 1.5.1 and older may incorrectly calculate t…7.5
• CVE-2023-30576Apache Guacamole 0.9.10 through 1.5.1 may continue to refere…8.1
• CVE-2023-30577AMANDA (Advanced Maryland Automatic Network Disk Archiver) b…7.8
• CVE-2023-3058A vulnerability was found in 07FLY CRM up to 1.2.0. It has b…5.4
• CVE-2023-30581The use of __proto__ in process.mainModule.__proto__.require…7.5
• CVE-2023-30582A vulnerability has been identified in Node.js version 20, a…5.3