Description
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter.


An attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extracted files to be written outside the intended extraction directory. This may allow the attacker to overwrite files accessible to the Pandora worker process and could potentially result in application compromise, arbitrary code execution, or denial of service depending on the files targeted and the privileges of the Pandora process.


The vulnerability is corrected by using Python's filter='data' extraction filter, which rejects or sanitizes dangerous TAR members, including paths that escape the destination directory and unsafe link targets.


The weakness corresponds to MITRE's general path traversal category, which includes archive extraction cases where attacker-controlled filenames cause files to be written outside the intended directory.
Published: 2026-08-15
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Pandora's TAR archive extraction routine accepts archive member names without sanitization, allowing a crafted TAR file to write files outside the designated extraction directory. This is a classic path traversal flaw (CWE-22) that can overwrite critical files used by the Pandora worker process, potentially leading to application compromise, arbitrary code execution, or denial of service, depending on which files are targeted and the privileges of the process.

Affected Systems

The vulnerability affects Pandora, the forensic analysis tool referenced by the product identifier pandora-analysis:pandora. No specific version information is listed, but the defect is addressed in the repository commit 186b58d41e04248a154d274fffb5813e7fa2012e.

Risk and Exploitability

With a CVSS score of 10 the flaw is considered critical. No EPSS score is available, and it is not yet listed in the CISA KEV catalog. An attacker who can submit a TAR file through any interface that triggers the extraction routine could exploit this weakness remotely. The paucity of blocking controls and the high severity indicate a high likelihood that exploitation could occur in a realistic threat environment.

Generated by OpenCVE AI on August 15, 2026 at 23:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Pandora to a version that implements Python's tarfile.TarFile.extract() with filter='data', which blocks unsafe paths.
  • If an immediate update is not feasible, modify the extraction code to pass filter='data' or otherwise sanitize member names before extraction to prevent directory traversal.
  • Configure the worker process to run with the least privilege necessary and enforce strict ownership and permissions on the extraction directory to reduce the impact of any remaining write attempts.

Generated by OpenCVE AI on August 15, 2026 at 23:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 15 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter. An attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extracted files to be written outside the intended extraction directory. This may allow the attacker to overwrite files accessible to the Pandora worker process and could potentially result in application compromise, arbitrary code execution, or denial of service depending on the files targeted and the privileges of the Pandora process. The vulnerability is corrected by using Python's filter='data' extraction filter, which rejects or sanitizes dangerous TAR members, including paths that escape the destination directory and unsafe link targets. The weakness corresponds to MITRE's general path traversal category, which includes archive extraction cases where attacker-controlled filenames cause files to be written outside the intended directory.
Title Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-08-15T21:39:09.862Z

Reserved: 2026-08-15T21:39:04.877Z

Link: CVE-2026-74764

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T22:16:55.563

Modified: 2026-08-15T22:16:55.563

Link: CVE-2026-74764

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T23:30:16Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')