EUVD-2026-56971Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Archive upload is network-accessible requiring PR:L; directory creation only (no file write) yields I:L and C:N; scope unchanged as impact is contained within the filebeat container.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirs(os.path.join(dest, entry.pathname)) that has no traversal protection. An uploaded malicious archive containing a directory entry with a ../ sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.
AnalysisAI
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary directories outside the intended extraction root on the filebeat processing container. All Malcolm releases prior to 26.07.0 are affected via the safe-extract.py component, which inconsistently applies traversal protections - libarchive secure flags guard file entries, but directory entries are passed directly to an unguarded os.makedirs() call. No confirmed active exploitation or public proof-of-concept has been identified; the vendor released a complete fix in version 26.07.0.
Technical ContextAI
Malcolm is a CISA-developed open-source network traffic analysis tool suite, identified by CPE cpe:2.3:a:cisagov:malcolm:*:*:*:*:*:*:*:*. The flaw is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and manifests as a split-codepath inconsistency in safe-extract.py: the script correctly enables libarchive's secure extraction flags to block traversal in regular file entries, but separately handles directory entries by calling os.makedirs(os.path.join(dest, entry.pathname)) with the raw, unsanitized entry.pathname value from the archive. A crafted archive embedding directory entries with ../ sequences or absolute paths (e.g., /tmp/malicious/) causes the Python runtime to create those directory structures at the resulting resolved path, bypassing the libarchive protections entirely. The vulnerable component runs inside the filebeat processing container, which bounds the impact to that container's filesystem.
RemediationAI
The primary remediation is to upgrade Malcolm to version 26.07.0, which patches safe-extract.py to sanitize directory entry pathnames before invoking os.makedirs(). The patched release is available at https://github.com/cisagov/Malcolm/releases/tag/v26.07.0 and the corresponding security advisory is at https://github.com/cisagov/Malcolm/security/advisories/GHSA-65mm-vgrw-vqx4. If immediate upgrade is not feasible, restrict archive upload access to the smallest possible set of trusted, fully authenticated users - this reduces exposure by raising the effective privilege bar for exploitation. As a secondary compensating control, consider isolating the filebeat processing container with restrictive filesystem mounts (read-only where possible, limited writable paths) so that even if traversal succeeds, the container cannot create directories in sensitive locations. Note that disabling archive processing entirely would eliminate the attack surface but would also impair Malcolm's core network capture ingestion functionality.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite ca
Unbounded archive extraction in Malcolm, CISA's network traffic analysis tool suite, allows a user who can reach the arc
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restr
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authori
Cross-site request forgery in the CISA Malcolm network traffic analysis platform lets a remote attacker who lures the op
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to
Malcolm's upload-processing pipeline allows an authenticated user with PCAP/log upload rights to exhaust the shared Dock
Authentication bypass in CISA Malcolm's shipped front nginx reverse proxy lets unauthenticated remote attackers reach th
Incorrect authorization in CISA Malcolm allows an authenticated low-privilege user to reach admin-only paths by percent-
Authentication bypass in CISA's Malcolm network traffic analysis platform lets any host with network adjacency to the Ma
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today