CVE-2026-24846
Unknown Unknown - Not Provided
Symlink Vulnerability in Malcontent Allows Directory Traversal

Publication date: 2026-01-29

Last updated on: 2026-02-24

Assigner: GitHub, Inc.

Description
malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-29
Last Modified
2026-02-24
Generated
2026-06-16
AI Q&A
2026-01-30
EPSS Evaluated
2026-06-14
NVD
CVE-2026-24846
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
chainguard malcontent From 1.8.0 (inc) to 1.20.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-683 The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

Upgrade malcontent to version 1.20.3 or later, as this version includes fixes that correct the handleSymlink argument order and validate symlink locations and targets to prevent exploitation.

Executive Summary

This vulnerability in malcontent versions starting from 1.8.0 up to before 1.20.3 involves improper handling of symbolic links (symlinks) during extraction of tar or deb archives. The function responsible for handling symlinks received its arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, the targets of these symlinks were not validated to ensure they resolved within the intended extraction directory. This flaw could allow creation of symlinks outside the extraction directory, potentially leading to unintended file system modifications.

Impact Analysis

This vulnerability can impact you by allowing an attacker to create symbolic links outside the intended extraction directory when scanning specially crafted archives. This could lead to unauthorized modification or overwriting of files outside the extraction scope, potentially compromising system integrity or security. The CVSS score indicates a moderate impact with high integrity impact but no confidentiality or availability impact.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart