CVE-2026-24846
Symlink Vulnerability in Malcontent Allows Directory Traversal
Publication date: 2026-01-29
Last updated on: 2026-02-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chainguard | malcontent | From 1.8.0 (inc) to 1.20.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-683 | The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Upgrade malcontent to version 1.20.3 or later, as this version includes fixes that correct the handleSymlink argument order and validate symlink locations and targets to prevent exploitation.
Can you explain this vulnerability to me?
This vulnerability in malcontent versions starting from 1.8.0 up to before 1.20.3 involves improper handling of symbolic links (symlinks) during extraction of tar or deb archives. The function responsible for handling symlinks received its arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, the targets of these symlinks were not validated to ensure they resolved within the intended extraction directory. This flaw could allow creation of symlinks outside the extraction directory, potentially leading to unintended file system modifications.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to create symbolic links outside the intended extraction directory when scanning specially crafted archives. This could lead to unauthorized modification or overwriting of files outside the extraction scope, potentially compromising system integrity or security. The CVSS score indicates a moderate impact with high integrity impact but no confidentiality or availability impact.