Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-88069: Pandora Analysis file extraction can overwrite files outside its folder
CVE-2026-88069 · published 1 month ago
Summary
Pandora Analysis may write files to locations it shouldn't when it extracts a specially crafted archive. If a malicious file is submitted, the extraction process could overwrite important application or system files, causing disruption or further compromise. To protect yourself, update Pandora Analysis to the latest version that checks and blocks such out‑of‑bounds file writes.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| pandora-analysis | pandora | <= 1.12.7 |
Original advisory text
Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis
Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory.
An attacker able to submit a malicious file for analysis could use path traversal sequences or crafted paths to cause extracted content to be written outside the designated extraction directory, potentially overwriting files accessible to the Pandora worker process. Successful exploitation could result in unauthorized modification of application or system files, denial of service, and potentially further compromise depending on the permissions of the Pandora process and the files that can be overwritten.
The vulnerability is addressed by resolving each extraction destination path before writing and verifying that it remains below the expected extraction directory. Extraction attempts resolving outside this directory are rejected and reported as path traversal attempts.
An attacker able to submit a malicious file for analysis could use path traversal sequences or crafted paths to cause extracted content to be written outside the designated extraction directory, potentially overwriting files accessible to the Pandora worker process. Successful exploitation could result in unauthorized modification of application or system files, denial of service, and potentially further compromise depending on the permissions of the Pandora process and the files that can be overwritten.
The vulnerability is addressed by resolving each extraction destination path before writing and verifying that it remains below the expected extraction directory. Extraction attempts resolving outside this directory are rejected and reported as path traversal attempts.
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published9 Sep 2026
Updated11 Oct 2026
First seen9 Sep 2026
Track software like this
Free during beta