Symlink Vulnerability in Malcontent Allows Directory Traversal

Publication date: 2026-01-29

Last updated on: 2026-02-24

Assigner: GitHub, Inc.

Description

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-29

Last Modified

2026-02-24

Generated

2026-07-06

AI Q&A

2026-01-30

EPSS Evaluated

2026-07-04

NVD

CVE-2026-24846

Affected Vendors & Products

Vendor	Product	Version / Range
chainguard	malcontent	From 1.8.0 (inc) to 1.20.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-683	The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Mitigation Strategies

Upgrade malcontent to version 1.20.3 or later, as this version includes fixes that correct the handleSymlink argument order and validate symlink locations and targets to prevent exploitation.

Executive Summary

This vulnerability in malcontent versions starting from 1.8.0 up to before 1.20.3 involves improper handling of symbolic links (symlinks) during extraction of tar or deb archives. The function responsible for handling symlinks received its arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, the targets of these symlinks were not validated to ensure they resolved within the intended extraction directory. This flaw could allow creation of symlinks outside the extraction directory, potentially leading to unintended file system modifications.

Impact Analysis

This vulnerability can impact you by allowing an attacker to create symbolic links outside the intended extraction directory when scanning specially crafted archives. This could lead to unauthorized modification or overwriting of files outside the extraction scope, potentially compromising system integrity or security. The CVSS score indicates a moderate impact with high integrity impact but no confidentiality or availability impact.

Hi! I’m here to help you understand CVE-2026-24846. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70