PAIT-ARV-100: Archive Slip Bugs in Machine-Learning Models

Overview

Many machine-learning artifacts are packaged archives containing weights, configuration, metadata, and auxiliary files. PAIT-ARV-100 describes a path-traversal condition in the extraction path: a malicious entry such as ../../config/startup can resolve outside the intended directory when the application does not validate archive names.

The finding belongs to the archive handling code, not to every ZIP, TAR, or PyTorch file. Impact depends on the extraction process, filesystem permissions, symlink handling, and whether the worker has access to startup scripts, credentials, or other services.

Safe extraction requirements

Extract into a newly created directory owned by the worker. For every entry:

• reject absolute paths and traversal components;
• resolve the final path and verify it remains below the destination;
• handle symlinks and hard links explicitly;
• enforce file-count, size, and compression-ratio limits;
• allow only expected extensions and permissions;
• write with a least-privilege service account.

Never extract an untrusted model directly into /, a shared application directory, a home directory, or a location containing configuration and credentials. A model intake service should finish extraction before the artifact is copied to the inference image.

Validation workflow

Use synthetic archives containing nested paths, absolute paths, symlinks, duplicate names, oversized files, and unexpected file types. Confirm that each is rejected or contained and that the event is logged with the source hash and owner. The positive test should also prove that a valid model still extracts and loads normally.

If the finding is confirmed, quarantine the artifact, identify every environment that downloaded it, and review file-integrity, process, and credential-use logs. Rebuild affected workers from a clean image rather than deleting only the overwritten file. Rotate credentials that were available to the extraction process.

Remediation

Sanitize paths during extraction, use a maintained archive library, and keep the extraction directory isolated from application code. Add negative tests to CI and record the archive digest and provenance before promotion. Treat model files as packages that need the same intake, approval, and rollback controls as other executable-adjacent artifacts.

Frequently asked questions

Does a model archive automatically contain Zip Slip risk?

No. The risk depends on the archive contents and the extraction implementation. Path handling must be tested.

Is a checksum enough?

It proves integrity relative to a trusted reference, but not safety. Combine provenance, format review, sandboxing, and runtime controls.

What closes the finding?

The extractor rejects traversal and link escapes, the behavior is covered by regression tests, and a retest shows that the artifact cannot write outside its assigned directory.