Description

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-11T21:17:44.307Z",
  "pubdate": "2026-08-11T21:17:44.307Z",
  "executiveSummary": "A directory traversal vulnerability exists in the Malcolm network traffic analysis tool suite prior to version 26.07.0.\nThe vulnerability resides in the safe-extract.py script, which fails to apply proper path traversal protection when creating directory entries during archive extraction.\nAn unauthenticated attacker capable of uploading a malicious archive can leverage this flaw to create directories outside the intended destination directory on the underlying host or container filesystem.\nWhen processed by the filebeat container, the application executes an insecure os.makedirs operation on directory paths containing relative traversal sequences such as ../ or absolute path notations.\nThis behavior leads to arbitrary directory creation with the privilege level of the executing container process, potentially impacting system integrity and container isolation boundaries.\nRemediation requires upgrading the Malcolm software suite to version 26.07.0 or later, where path validation controls for directory creation are properly implemented.",
  "technicalDetails": "The vulnerability is rooted in insufficient input validation and path sanitization within the safe-extract.py script of the Malcolm network traffic analysis tool suite.\nWhile file extraction operations benefit from libarchive's secure extraction flags, directory entry creation bypasses these protective measures by directly executing a raw os.makedirs(os.path.join(dest, entry.pathname)) function call.\nThe vulnerable component is specifically the directory creation routine handling archive payloads within the filebeat processing container.\nAffected versions comprise all releases of the Malcolm tool suite prior to version 26.07.0.\nExploitation requires the attacker to supply a crafted malicious archive containing specially manipulated directory entries.\nThese entries incorporate directory traversal sequences, such as dot-dot-slash (../) patterns or absolute file system paths, designed to escape the designated extraction boundary (dest).\nThe step-by-step attack flow proceeds as follows: First, the attacker uploads or introduces a malicious archive into the processing pipeline handled by Malcolm. Second, the filebeat container processes the archive via the safe-extract.py script. Third, while libarchive secure flags may protect file payloads, the extraction logic iterates over directory entries and calls os.makedirs using the raw entry.pathname without validating whether the resolved path resides within the intended destination directory. Fourth, the operating system creates the requested directories at arbitrary locations on the filesystem outside the extraction folder, dictated by the traversal sequences.\nPrivilege and authentication requirements depend on the deployment configuration exposed by Malcolm for accepting archive uploads, but successful exploitation results in unauthorized file system modification and directory structure manipulation outside containment boundaries."
}