Malcolm’s archive extraction process uses libarchive with security flags, but then creates directory entries with a raw os.makedirs call that ignores path traversal validation. An attacker can embed a directory entry containing a ‘../’ sequence or an absolute path in an uploaded archive, causing the container running the filebeat processor to create directories outside the intended extraction location. This break in isolation may allow malicious files to be placed in privileged directories or otherwise subvert expected boundaries, potentially leading to contamination or privilege escalation. The vulnerability is documented as CWE‑22. The impact is primarily confinement bypass – the tool’s sandbox is bypassed and the attacker can influence the file system structure in the host container.

All versions of cisagov’s Malcolm network traffic analysis suite released prior to version 26.07.0 are affected. The flaw occurs during the archive extraction step that runs inside the filebeat processing container. Users of Malcolm before this release should consider their deployments vulnerable. The update to version 26.07.0 removes the insecure directory creation logic, aligning extraction with safe‑extract.py’s traversal protection.

The CVSS score for this issue is 5.4, indicating moderate risk. The EPSS score is below 1 %, suggesting that exploitation is unlikely to be common, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who can supply a malicious archive to Malcolm’s extraction workflow – for example, via a user‑upload or data ingestion pipeline. While the full exploitation chain is not detailed, the description indicates that the flaw can be triggered simply by the presence of a crafted archive entry, making it relatively straightforward for a qualified attacker in the same container context.