Malcontent, a tool for detecting supply‑chain compromises, contains a flaw in its archive‑extraction logic that allows an attacker to craft a tar or deb archive to create symbolic links outside the intended extraction directory. The handleSymlink function receives arguments in the wrong order, so the symlink target is used as the link location, and no validation ensures that the link remains within the extraction path. When an attacker supplies such an archive, the tool can write files to arbitrary locations on the filesystem, potentially modifying system files or overwriting critical data. This weakness is reflected in CWE‑22 (Absolute Path Traversal) and CWE‑683 (Trusting Incorrect Data Returned from a Standard Library Function).

The vulnerability affects chainguard‑dev's Malcontent, specifically all releases from version 1.8.0 up to, but not including, version 1.20.3. Users running any of these versions are susceptible to arbitrary writes caused by maliciously crafted archives.

The CVSS score of 5.5 indicates a moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. Malcontent is not listed in the CISA Trusted Exploited Vulnerabilities catalog. An attacker would need to supply a specially crafted tar or deb file to the application—likely during an automated or user‑initiated scan—to exploit this flaw. Because the bug only affects the interpretation of symlink targets within archive extraction, it does not provide remote code execution but can lead to privilege escalation or data loss if the application runs with elevated permissions.