CVE-2026-74764

Received Received - Intake

Path Traversal in Pandora TAR Archive Extraction

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter. An attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extracted files to be written outside the intended extraction directory. This may allow the attacker to overwrite files accessible to the Pandora worker process and could potentially result in application compromise, arbitrary code execution, or denial of service depending on the files targeted and the privileges of the Pandora process. The vulnerability is corrected by using Python's filter='data' extraction filter, which rejects or sanitizes dangerous TAR members, including paths that escape the destination directory and unsafe link targets. The weakness corresponds to MITRE's general path traversal category, which includes archive extraction cases where attacker-controlled filenames cause files to be written outside the intended directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-74764

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Pandora has a path traversal vulnerability in its TAR archive extraction. When processing a TAR file, it directly passes member names to Python's tarfile.TarFile.extract() without filtering. Attackers can craft malicious paths with ../ or absolute paths to write files outside the intended directory, potentially overwriting files or executing arbitrary code.

Detection Guidance

To detect this vulnerability, inspect TAR archives processed by Pandora for malicious paths. Check for sequences like ../ or absolute paths in filenames. Review logs for extraction failures or unexpected file writes outside intended directories.

Impact Analysis

This vulnerability allows attackers to overwrite files accessible to the Pandora worker process. Depending on the files targeted and the process's privileges, it could lead to application compromise, arbitrary code execution, or denial of service.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized file access or modification. Attackers could overwrite sensitive files, potentially exposing or altering personal data, which violates data protection requirements under these regulations.

Mitigation Strategies

Apply Python's tarfile.TarFile.extract() with filter='data' to sanitize TAR member paths. Update Pandora to the patched version that includes this fix. Restrict Pandora worker process permissions to limit file overwrite impact.

Hi! I’m here to help you understand CVE-2026-74764. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70