Vulnerabilities & PatchesEmerging1 sourceAug 11, 2026 · 20:29via CVEFeed

CVE-2026-63134 - Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation

Brief

CVE ID : CVE-2026-63134

Published : Aug. 11, 2026, 8:29 p. m.

Description : Malcolm is a network traffic analysis tool suite. Prior to version 26.

0, `safe-extract. py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os. makedirs(os. path. join(dest, entry. pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `..

/` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.

Severity: 0.0

Visit the link for more details, such as CVSS details, affected products, timeline, and more...