CVE-2026-24846: malcontent Path Traversal Vulnerability

CVE-2026-24846 Overview

CVE-2026-24846 is a Path Traversal vulnerability affecting malcontent, a supply-chain security tool developed by Chainguard that discovers compromises through context, differential analysis, and YARA. The vulnerability exists in versions 1.8.0 through 1.20.2, where malcontent could be manipulated to create symlinks outside the intended extraction directory when scanning specially crafted tar or deb archives.

The root cause involves the handleSymlink function receiving arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory, enabling attackers to write files to arbitrary locations on the filesystem.

Critical Impact

Attackers can craft malicious tar or deb archives that, when scanned by malcontent, create arbitrary symlinks outside the extraction directory, potentially leading to file overwrite or unauthorized file access on systems running the vulnerable tool.

Affected Products

• malcontent versions 1.8.0 through 1.20.2
• Systems using malcontent to scan untrusted tar archives
• Systems using malcontent to scan untrusted deb packages

Discovery Timeline

• 2026-01-29 - CVE CVE-2026-24846 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24846

Vulnerability Analysis

This Path Traversal vulnerability (CWE-22) allows an attacker to escape the intended extraction directory through symlink manipulation. The vulnerability requires local access and user interaction, as an attacker must convince a user to scan a malicious archive file. The primary impact is to integrity, as the vulnerability enables arbitrary file writes or modifications through symlink creation, though it does not directly expose confidential data or cause denial of service.

The vulnerability is particularly concerning in supply-chain security contexts, as malcontent is specifically designed to analyze potentially malicious software packages. An attacker could craft a trojanized archive that exploits the very tool meant to detect such compromises.

Root Cause

The vulnerability stems from two distinct issues in the handleSymlink function within pkg/archive/archive.go:

1. Argument Order Error: The function parameters for the symlink path and target were passed in the wrong order, causing the intended symlink target to be used as the symlink location and vice versa.

2. Missing Validation: Symlink targets were not validated to ensure they resolved within the extraction directory, allowing relative paths like ../../../etc/passwd to escape the sandbox.

Attack Vector

The attack requires local access to the system running malcontent. An attacker must craft a malicious tar or deb archive containing specially constructed symlinks. When a user scans the archive with a vulnerable version of malcontent, the tool extracts the symlinks without proper validation, allowing the attacker to:

1. Create symlinks pointing to arbitrary locations outside the extraction directory
2. Potentially overwrite critical system files or configuration
3. Establish persistent access by linking to startup scripts or configuration files

The fixed code corrects the argument order and adds proper validation:

// handleSymlink creates valid symlinks when extracting .deb or .tar archives.
// linkPath is where the symlink will be created (relative to dir).
// linkTarget is what the symlink points to.
func handleSymlink(dir, linkPath, linkTarget string) error {
	fullPath := filepath.Join(dir, linkPath)

	// Validate symlink location is within extraction directory
	if !IsValidPath(fullPath, dir) {
		return fmt.Errorf("symlink location outside extraction directory: %s", fullPath)
	}

	// Remove existing symlinks
	if _, err := os.Lstat(fullPath); err == nil {
		if err := os.Remove(fullPath); err != nil {
			return fmt.Errorf("failed to remove existing symlink: %w", err)
		}
	}

Source: GitHub Commit

Additional validation was added to prevent symlink target escapes:

	// Skip absolute symlink targets
	if filepath.IsAbs(linkTarget) {
		return nil
	}

	// Validate relative symlink target resolves within extraction directory
	resolvedTarget := filepath.Clean(filepath.Join(filepath.Dir(fullPath), linkTarget))
	if !IsValidPath(resolvedTarget, dir) {
		return fmt.Errorf("symlink target escapes extraction directory: %s -> %s", linkPath, linkTarget)
	}

Source: GitHub Commit

Detection Methods for CVE-2026-24846

Indicators of Compromise

• Presence of unexpected symlinks in system directories following malcontent archive scans
• Modified system files or configurations that coincide with malcontent scanning activities
• Symlinks in temporary extraction directories pointing outside the expected extraction path

Detection Strategies

• Monitor file system events for symlink creation operations by the malcontent process
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized symlink creation
• Review malcontent execution logs for errors related to symlink handling or path validation failures
• Audit systems running malcontent versions between 1.8.0 and 1.20.2 for signs of exploitation

Monitoring Recommendations

• Enable detailed logging for malcontent operations, particularly archive extraction activities
• Configure security tools to alert on symlink creation events originating from malcontent processes
• Implement canary files in sensitive directories to detect unauthorized access or modification
• Monitor for unusual file system activity patterns during scheduled or ad-hoc archive scans

How to Mitigate CVE-2026-24846

Immediate Actions Required

• Upgrade malcontent to version 1.20.3 or later immediately
• Audit systems for any unauthorized symlinks that may have been created by previous scans
• Review recently scanned archives for potentially malicious content
• Restrict malcontent execution to isolated environments or containers when scanning untrusted archives

Patch Information

The vulnerability is fixed in malcontent version 1.20.3. The patch introduces three key fixes:

1. Corrects the argument order in the handleSymlink function calls
2. Validates that symlink locations remain within the extraction directory
3. Validates that symlink targets resolve within the extraction directory

For detailed patch information, refer to the GitHub Security Advisory and the associated commits on GitHub.

Workarounds

• Run malcontent in a containerized or sandboxed environment with restricted filesystem access
• Use read-only mounts for sensitive system directories when executing malcontent
• Pre-validate archive contents using alternative tools before scanning with vulnerable malcontent versions
• Implement strict access controls limiting which users can execute malcontent

# Configuration example
# Run malcontent in a restricted container environment
docker run --rm --read-only \
  --mount type=bind,source=/path/to/archives,target=/archives,readonly \
  --mount type=tmpfs,target=/tmp \
  chainguard/malcontent:1.20.3 analyze /archives/suspect.tar