CVE-2026-63134: Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirs(os.path.join(dest, entry.pathname)) that has no traversal protection. An uploaded malicious archive containing a directory entry with a ../ sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in 26.07.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63134?
CVE-2026-63134 has a medium severity rating of 5.4.
How do I fix CVE-2026-63134?
To fix CVE-2026-63134, upgrade Malcolm to version 26.07.0 or later.
What type of vulnerability is CVE-2026-63134?
CVE-2026-63134 is a path traversal vulnerability that allows arbitrary directory creation during archive extraction.
What software is affected by CVE-2026-63134?
CVS-2026-63134 affects the Malcolm network traffic analysis tool suite prior to version 26.07.0.
What is the impact of CVE-2026-63134?
The impact of CVE-2026-63134 is the potential creation of arbitrary directories by a malicious user during the archive extraction process.