CVE-2026-90445: Path Traversal
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process. This could allow an attacker to inject fabricated records into the system's stored data or tamper with application configuration.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in latest version
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to upload an archive through the affected interface. Exploitation is limited to files and locations writable by the extraction process's privileges.
What can an attacker do after successful exploitation?
A crafted archive can cause files to be written outside the intended extraction directory. The described impacts include injecting fabricated records into stored data and tampering with application configuration.
How can teams reduce exposure if they cannot patch immediately?
Restrict access to the archive-upload interface to only trusted authenticated users and limit the extraction process's filesystem permissions. These measures reduce who can submit malicious archives and which locations an extraction process can modify.