EUVD-2026-56971Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Archive upload is network-accessible requiring PR:L; directory creation only (no file write) yields I:L and C:N; scope unchanged as impact is contained within the filebeat container.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirs(os.path.join(dest, entry.pathname)) that has no traversal protection. An uploaded malicious archive containing a directory entry with a ../ sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.
AnalysisAI
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary directories outside the intended extraction root on the filebeat processing container. All Malcolm releases prior to 26.07.0 are affected via the safe-extract.py component, which inconsistently applies traversal protections - libarchive secure flags guard file entries, but directory entries are passed directly to an unguarded os.makedirs() call. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated access to Malcolm corresponding to CVSS PR:L - the attacker must hold a low-privilege account with sufficient permissions to upload archives to the Malcolm processing pipeline. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 Medium score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) accurately reflects the constrained real-world impact: exploitation requires authenticated access, the scope is contained within the filebeat container, and the attacker can only create directories - not write arbitrary file content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privilege authenticated access to a Malcolm deployment constructs an archive file containing a directory entry with a pathname such as `../../sensitive_dir`. Upon uploading the archive for processing, Malcolm's filebeat container invokes `safe-extract.py`, which calls `os.makedirs()` on the unsanitized path, resolving the traversal sequence and creating the target directory outside the extraction root. … |
| Remediation | The primary remediation is to upgrade Malcolm to version 26.07.0, which patches `safe-extract.py` to sanitize directory entry pathnames before invoking `os.makedirs()`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Malcolm (cisagov) prior to version 26.06.1 allows an authenticated user holding the ROLE_UPLOAD
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restr
Resource exhaustion in Malcolm's archive extraction component allows authenticated network users to deny service to the
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today