Pandora’s archive extraction worker does not properly normalize or check extraction paths, allowing an attacker to include directory traversal sequences in a malicious archive or disk image. When the worker resolves these paths, it may write files outside the intended extraction directory, overwriting arbitrary files owned by the Pandora process. This flaw is a classic path‑traversal vulnerability (CWE‑22) and can lead to unauthorized file modifications, denial of service, and a potential foothold for further exploitation if the overwritten files influence application logic or system state.

The vulnerability affects the Pandora analysis tool. No specific version numbers are listed in the advisory, so all deployments of Pandora that perform archive extraction are potentially impacted until a patch is applied.

The CVSS base score is 9.3, indicating critical severity. EPSS is not available, and KEV is not listed. The exploit can be triggered remotely by submitting a specially crafted file for analysis. Successful exploitation would allow path traversal into any location writable by the Pandora worker, enabling file overwrite attacks. Because the flaw does not require local access or additional credential escalation, the risk of compromise is high, especially on systems where the Pandora process runs with elevated privileges.