CyberRota Analysis
AI-GeneratedMalcolm's `safe-extract.py` script is vulnerable to directory traversal attacks due to improper handling of directory entries, allowing malicious archives to create directories outside the intended extraction path. This can lead to unauthorized file system access and potential data compromise. Users of Malcolm prior to version 26.07.0 should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.