CVE-2026-3067
Path Traversal in HummerRisk Archive Extraction Allows Remote Attack
Publication date: 2026-02-24
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hummerrisk | hummerrisk | to 1.5.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3067 is a critical path traversal vulnerability in HummerRisk versions up to 1.5.0, specifically in the archive extraction functions extractTarGZ and extractZip. The vulnerability occurs because the software fails to properly validate or sanitize file paths inside tar.gz and zip archives during extraction.
This flaw allows an authenticated attacker with file upload permissions to manipulate archive entry names using path traversal sequences (e.g., ../) to escape the intended extraction directory. As a result, the attacker can write arbitrary files anywhere on the filesystem.
Exploitation can lead to arbitrary file writes such as injecting SSH keys for root access, creating malicious cron jobs, uploading web shells, or replacing application libraries, potentially resulting in remote code execution and full system compromise.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized file system access, remote code execution, and privilege escalation.
- Attackers can write arbitrary files anywhere on the system, including sensitive locations.
- They can inject SSH keys to gain root access.
- Malicious cron jobs can be created to execute harmful scripts with system privileges.
- Web shells can be uploaded to enable remote command execution.
- Critical application libraries can be replaced to maintain persistence and execute code on restart.
Overall, the vulnerability compromises confidentiality, integrity, and availability of the affected system, potentially leading to full system compromise and root privilege escalation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "Detection of this vulnerability involves monitoring for suspicious archive uploads and extraction activities that include path traversal sequences such as '../' in file names within tar.gz or zip archives."}, {'type': 'paragraph', 'content': 'Since the vulnerability is exploited by uploading crafted archives via endpoints like POST /fs/add/fs, inspecting logs for such requests and analyzing uploaded archive contents for path traversal patterns is recommended.'}, {'type': 'paragraph', 'content': 'Commands to detect potential exploitation attempts could include scanning extracted files for unexpected locations or unauthorized files such as SSH keys in /root/.ssh/authorized_keys, cron jobs in /etc/cron.d/, or web shells in web root directories.'}, {'type': 'list_item', 'content': "Use find commands to locate suspicious files, e.g., `find / -name '*.jsp'` to find web shells."}, {'type': 'list_item', 'content': 'Check for unauthorized SSH keys: `cat /root/.ssh/authorized_keys` and verify contents.'}, {'type': 'list_item', 'content': 'Monitor web server logs and application logs for unusual archive upload activity.'}, {'type': 'list_item', 'content': 'Use file integrity monitoring tools to detect unexpected file changes outside normal directories.'}] [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling archive upload and extraction functionality in HummerRisk versions up to 1.5.0 until a fix or patch is available.
Since no official patches or vendor responses are available, consider replacing the affected component with an alternative product that does not have this vulnerability.
Implement strict validation and sanitization of archive entry paths before extraction to prevent path traversal, including canonicalizing paths and rejecting entries that escape the intended extraction directory.
- Perform extraction in sandboxed environments such as containers or chroot jails to limit potential damage.
- Enforce file type whitelists and limit extracted file sizes.
- Reject symbolic links that point outside the extraction directory.
- Scan extracted content for malicious patterns immediately after extraction.
Monitor systems for signs of compromise such as unauthorized SSH keys, cron jobs, or web shells and respond accordingly.