CVE-2026-63134

Received Received - Intake

Directory Traversal in Malcolm Network Traffic Analysis Tool

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-63134

Affected Vendors & Products

Vendor	Product	Version / Range
malcolm	network_traffic_analysis_tool_suite	26.07.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in Malcolm network traffic analysis tool suite before version 26.07.0 allows directory traversal during file extraction. The safe-extract.py script uses libarchive's secure flags but creates directories using os.makedirs with a raw entry.pathname. Malicious archives with ../ sequences or absolute paths can create directories outside the intended extraction directory, potentially affecting the filebeat processing container.

Detection Guidance

Check Malcolm's logs for unusual directory creation outside intended paths. Look for archives with path traversal sequences like '../' or absolute paths in extraction logs.

Impact Analysis

An attacker could exploit this to write files or directories outside the intended extraction location. This might allow unauthorized access to system files, disruption of services, or further compromise of the Malcolm tool suite or host system.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosure of sensitive information, or failure to maintain data integrity, potentially leading to compliance violations and legal consequences.

Mitigation Strategies

Upgrade Malcolm to version 26.07.0 or later to fix the directory traversal issue in safe-extract.py.

Hi! I’m here to help you understand CVE-2026-63134. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70