Description

A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T20:17:01.147Z",
  "pubdate": "2026-08-25T20:17:01.147Z",
  "executiveSummary": "A critical path traversal vulnerability exists within the OPSWAT tarball component utilized by the SonicWall NetExtender Linux client.\nThis vulnerability allows a local, unprivileged attacker to perform arbitrary file writes on the filesystem with root privileges.\nThe flaw stems from insufficient input validation during the extraction process of the OPSWAT package, which fails to sanitize directory traversal sequences (e.g., ../) in file paths.\nBy crafting a malicious archive, an attacker can overwrite sensitive system files, potentially leading to full system compromise, privilege escalation, and persistent unauthorized access.\nBecause the operation is executed with root permissions, the integrity and confidentiality of the host operating system are directly compromised.\nThis issue is particularly severe in environments where standard users have the ability to trigger the update or package installation processes for the NetExtender client.",
  "technicalDetails": "The vulnerability resides in the routine responsible for unpacking the OPSWAT tarball included in the SonicWall NetExtender Linux client. The root cause is a failure to properly sanitize file paths contained within the archive metadata during the extraction process. Specifically, the software does not implement adequate validation to detect or neutralize directory traversal sequences such as '../'.\nWhen the affected component processes an archive, it fails to verify that the target destination of the extracted files remains within the intended installation directory. An attacker can manipulate the archive headers to include filenames that contain path traversal patterns. When the extraction utility processes these headers, it resolves the traversal sequences, causing the file write operation to occur outside the designated sandbox or temporary directory.\nBecause the extraction process is executed with root privileges, the file write operation is not bound by the restrictions of the user invoking the application. An attacker can target critical system files, such as /etc/shadow, /etc/passwd, or shell configuration files (e.g., ~/.bashrc or /etc/profile), allowing for arbitrary code execution, credential manipulation, or the installation of backdoors.\nThe attack flow follows a structured path: first, the attacker prepares a malicious tarball containing entries with traversal sequences that map to a sensitive file path on the host filesystem. Second, the attacker triggers the NetExtender client or the OPSWAT component to process this malicious archive. Third, the extraction logic performs the write operation at the resolved traversal destination. Finally, the attacker leverages the overwritten system file to escalate privileges or gain persistent root-level access.\nThis vulnerability is classified as a local attack vector. It requires the attacker to have the ability to provide or substitute the target archive that the NetExtender client consumes. The exposure is high for multi-user Linux environments or systems where automated update mechanisms can be coerced into processing maliciously provided archives. The exploit successfully bypasses standard filesystem permissions because the target process executes with elevated system-level authorization, effectively transforming a file-writing flaw into a full root-level privilege escalation."
}