CVE-2026-24846

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24846", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-27T14:51:03.059Z", "datePublished": "2026-01-29T21:12:18.991Z", "dateUpdated": "2026-01-29T21:37:29.730Z"}, "containers": {"cna": {"title": "malcontent's archive extraction could write outside extraction directory", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-683", "lang": "en", "description": "CWE-683: Function Call With Incorrect Order of Arguments", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-923j-vrcg-hxwh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-923j-vrcg-hxwh"}, {"name": "https://github.com/chainguard-dev/malcontent/commit/259fca5abc004f3ab238895463ef280a87f30e96", "tags": ["x_refsource_MISC"], "url": "https://github.com/chainguard-dev/malcontent/commit/259fca5abc004f3ab238895463ef280a87f30e96"}, {"name": "https://github.com/chainguard-dev/malcontent/commit/a7dd8a5328ddbaf235568437813efa7591e00017", "tags": ["x_refsource_MISC"], "url": "https://github.com/chainguard-dev/malcontent/commit/a7dd8a5328ddbaf235568437813efa7591e00017"}], "affected": [{"vendor": "chainguard-dev", "product": "malcontent", "versions": [{"version": ">= 1.8.0, < 1.20.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T21:12:18.991Z"}, "descriptions": [{"lang": "en", "value": "malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory."}], "source": {"advisory": "GHSA-923j-vrcg-hxwh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T21:35:11.721178Z", "id": "CVE-2026-24846", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:37:29.730Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24846", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T21:35:11.721178Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:37:04.798Z"}}], "cna": {"title": "malcontent's archive extraction could write outside extraction directory", "source": {"advisory": "GHSA-923j-vrcg-hxwh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "chainguard-dev", "product": "malcontent", "versions": [{"status": "affected", "version": ">= 1.8.0, < 1.20.3"}]}], "references": [{"url": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-923j-vrcg-hxwh", "name": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-923j-vrcg-hxwh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/chainguard-dev/malcontent/commit/259fca5abc004f3ab238895463ef280a87f30e96", "name": "https://github.com/chainguard-dev/malcontent/commit/259fca5abc004f3ab238895463ef280a87f30e96", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/chainguard-dev/malcontent/commit/a7dd8a5328ddbaf235568437813efa7591e00017", "name": "https://github.com/chainguard-dev/malcontent/commit/a7dd8a5328ddbaf235568437813efa7591e00017", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-683", "description": "CWE-683: Function Call With Incorrect Order of Arguments"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T21:12:18.991Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24846", "state": "PUBLISHED", "dateUpdated": "2026-01-29T21:37:29.730Z", "dateReserved": "2026-01-27T14:51:03.059Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-29T21:12:18.991Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "malcontent", "vendor": "chainguard-dev", "versions": [{"status": "affected", "version": ">= 1.8.0, < 1.20.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chainguard:malcontent:*:*:*:*:*:*:*:*", "matchCriteriaId": "07A5D3A2-09F1-44A0-AF84-E943CF3DC18C", "versionEndExcluding": "1.20.3", "versionStartIncluding": "1.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory."}, {"lang": "es", "value": "malcontent descubre compromisos en la cadena de suministro a trav\u00e9s de contexto, an\u00e1lisis diferencial y YARA. A partir de la versi\u00f3n 1.8.0 y antes de la versi\u00f3n 1.20.3, se pod\u00eda hacer que malcontent creara enlaces simb\u00f3licos fuera del directorio de extracci\u00f3n previsto al escanear un archivo tar o deb especialmente dise\u00f1ado. La funci\u00f3n 'handleSymlink' recibi\u00f3 argumentos en el orden incorrecto, lo que provocaba que el destino del enlace simb\u00f3lico se utilizara como la ubicaci\u00f3n del enlace simb\u00f3lico. Adem\u00e1s, los destinos de los enlaces simb\u00f3licos no se validaban para asegurar que se resolvieran dentro del directorio de extracci\u00f3n. La versi\u00f3n 1.20.3 introduce correcciones que intercambian los argumentos de 'handleSymlink', validan la ubicaci\u00f3n del enlace simb\u00f3lico y validan los destinos de los enlaces simb\u00f3licos que se resuelven dentro de un directorio de extracci\u00f3n."}], "id": "CVE-2026-24846", "lastModified": "2026-06-17T10:23:41.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24846", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T21:35:11.721178Z", "version": "2.0.3"}}]}, "published": "2026-01-29T22:15:54.740", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/chainguard-dev/malcontent/commit/259fca5abc004f3ab238895463ef280a87f30e96"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/chainguard-dev/malcontent/commit/a7dd8a5328ddbaf235568437813efa7591e00017"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-923j-vrcg-hxwh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-683"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:31:28.182613+00:00", "value": {"mitigation_remediation": ["Upgrade malcontent to version 1.20.3 or later, which corrects the argument order and validates symlink locations and targets.", "Run the scanning process in a restricted environment (e.g., a container or dedicated low\u2011privilege user) that does not have write access to sensitive system directories, reducing the impact if a symlink slip occurs.", "Manually verify or automatically check extracted files for symlink paths that resolve outside the intended extraction directory before deployment, ensuring no unauthorized filesystem writes can occur."], "summary": {"action": "Patch", "impact": "Unauthorized filesystem write"}, "threat_synthesis": {"affected_systems": "The vulnerability affects chainguard\u2011dev's Malcontent, specifically all releases from version 1.8.0 up to, but not including, version 1.20.3. Users running any of these versions are susceptible to arbitrary writes caused by maliciously crafted archives.", "description_and_impact": "Malcontent, a tool for detecting supply\u2011chain compromises, contains a flaw in its archive\u2011extraction logic that allows an attacker to craft a tar or deb archive to create symbolic links outside the intended extraction directory. The handleSymlink function receives arguments in the wrong order, so the symlink target is used as the link location, and no validation ensures that the link remains within the extraction path. When an attacker supplies such an archive, the tool can write files to arbitrary locations on the filesystem, potentially modifying system files or overwriting critical data. This weakness is reflected in CWE\u201122 (Absolute Path Traversal) and CWE\u2011683 (Trusting Incorrect Data Returned from a Standard Library Function).", "risk_and_exploitability": "The CVSS score of 5.5 indicates a moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. Malcontent is not listed in the CISA Trusted Exploited Vulnerabilities catalog. An attacker would need to supply a specially crafted tar or deb file to the application\u2014likely during an automated or user\u2011initiated scan\u2014to exploit this flaw. Because the bug only affects the interpretation of symlink targets within archive extraction, it does not provide remote code execution but can lead to privilege escalation or data loss if the application runs with elevated permissions."}}}}, "created": "2026-01-30T08:42:21.915133+00:00", "updated": "2026-04-18T14:45:03.114811+00:00", "vendors": ["chainguard-dev", "chainguard-dev$PRODUCT$malcontent"]}