CVE-2026-88069: Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis
Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory.
An attacker able to submit a malicious file for analysis could use path traversal sequences or crafted paths to cause extracted content to be written outside the designated extraction directory, potentially overwriting files accessible to the Pandora worker process. Successful exploitation could result in unauthorized modification of application or system files, denial of service, and potentially further compromise depending on the permissions of the Pandora process and the files that can be overwritten.
The vulnerability is addressed by resolving each extraction destination path before writing and verifying that it remains below the expected extraction directory. Extraction attempts resolving outside this directory are rejected and reported as path traversal attempts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the archive/disk extraction logic to resolve the destination path prior to writing, then verify the resolved destination remains within the intended extraction directory; do not write attacker-controlled paths that escape the extraction root.
Pandora archive extraction worker path resolution and destination validation = resolve each extraction destination path before writing and verify it remains below the expected extraction directory - Compensating control
Ensure Pandora archive extraction worker rejects any extraction attempt where the resolved extraction destination path would fall outside the designated extraction directory (treat as path traversal and reject/reports).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to submit a specially crafted archive or disk image for Pandora to analyze. The practical impact depends on which files the Pandora worker process can write or overwrite.
What does successful exploitation allow?
A crafted extraction path can cause content to be written outside the intended extraction directory, potentially overwriting application or system files accessible to the worker. This can cause unauthorized file modification or denial of service and may enable further compromise depending on worker permissions.
How can I tell whether an extraction attempt was blocked by the fix?
The corrected extraction logic rejects destinations that resolve outside the expected extraction directory and reports them as path traversal attempts. Review Pandora's extraction reporting for path traversal attempt messages.