Executive Summary

CVE-2026-3067 is a critical path traversal vulnerability in HummerRisk versions up to 1.5.0, specifically in the archive extraction functions extractTarGZ and extractZip. The vulnerability occurs because the software fails to properly validate or sanitize file paths inside tar.gz and zip archives during extraction.

This flaw allows an authenticated attacker with file upload permissions to manipulate archive entry names using path traversal sequences (e.g., ../) to escape the intended extraction directory. As a result, the attacker can write arbitrary files anywhere on the filesystem.

Exploitation can lead to arbitrary file writes such as injecting SSH keys for root access, creating malicious cron jobs, uploading web shells, or replacing application libraries, potentially resulting in remote code execution and full system compromise.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized file system access, remote code execution, and privilege escalation.

• Attackers can write arbitrary files anywhere on the system, including sensitive locations.
• They can inject SSH keys to gain root access.
• Malicious cron jobs can be created to execute harmful scripts with system privileges.
• Web shells can be uploaded to enable remote command execution.
• Critical application libraries can be replaced to maintain persistence and execute code on restart.

Overall, the vulnerability compromises confidentiality, integrity, and availability of the affected system, potentially leading to full system compromise and root privilege escalation.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "Detection of this vulnerability involves monitoring for suspicious archive uploads and extraction activities that include path traversal sequences such as '../' in file names within tar.gz or zip archives."}, {'type': 'paragraph', 'content': 'Since the vulnerability is exploited by uploading crafted archives via endpoints like POST /fs/add/fs, inspecting logs for such requests and analyzing uploaded archive contents for path traversal patterns is recommended.'}, {'type': 'paragraph', 'content': 'Commands to detect potential exploitation attempts could include scanning extracted files for unexpected locations or unauthorized files such as SSH keys in /root/.ssh/authorized_keys, cron jobs in /etc/cron.d/, or web shells in web root directories.'}, {'type': 'list_item', 'content': "Use find commands to locate suspicious files, e.g., `find / -name '*.jsp'` to find web shells."}, {'type': 'list_item', 'content': 'Check for unauthorized SSH keys: `cat /root/.ssh/authorized_keys` and verify contents.'}, {'type': 'list_item', 'content': 'Monitor web server logs and application logs for unusual archive upload activity.'}, {'type': 'list_item', 'content': 'Use file integrity monitoring tools to detect unexpected file changes outside normal directories.'}] [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or disabling archive upload and extraction functionality in HummerRisk versions up to 1.5.0 until a fix or patch is available.

Since no official patches or vendor responses are available, consider replacing the affected component with an alternative product that does not have this vulnerability.

Implement strict validation and sanitization of archive entry paths before extraction to prevent path traversal, including canonicalizing paths and rejecting entries that escape the intended extraction directory.

• Perform extraction in sandboxed environments such as containers or chroot jails to limit potential damage.
• Enforce file type whitelists and limit extracted file sizes.
• Reject symbolic links that point outside the extraction directory.
• Scan extracted content for malicious patterns immediately after extraction.

Monitor systems for signs of compromise such as unauthorized SSH keys, cron jobs, or web shells and respond accordingly.

Useful 0 Not Useful 0