Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-63134: Malcolm: Malicious Archive Extraction Creates Unintended Directories

CVE-2026-63134 · published 2 months ago

Summary

Malcolm's file extraction tool is vulnerable to creating unintended directories when processing malicious archives. This could allow an attacker to create directories outside of the intended extraction area, potentially leading to unauthorized access or data exposure. Update to version 26.07.0 or later to address this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisagov	malcolm	< 26.07.0

Original advisory text

Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.

References

https://github.com/cisagov/Malcolm/releases/tag/v26.07.0 URL
https://github.com/cisagov/Malcolm/security/advisories/GHSA-65mm-vgrw-vqx4 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63134... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63134 Vendor Advisory
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-23... URL
https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published11 Aug 2026

Updated4 Nov 2026

First seen11 Aug 2026

Sources

CVE-2026-63134 · NVD

CVE-2026-63134 · MITRE

CVE-2026-63134 · OSV

GHSA-65mm-vgrw-vqx4 · GHSA

Track software like this

Free during beta