CVE-2026-50558: Penelope Shell Handler Path Traversal

CVE-2026-50558 Overview

CVE-2026-50558 is a path traversal vulnerability [CWE-22] in Penelope Shell Handler, a post-exploitation shell handler used for authorized security testing. Versions prior to 0.20.0 invoke tar.extractall(local_download_folder) on archives returned by remote sessions without validating member paths. A malicious or compromised remote session can craft a tar archive with traversal entries to write files outside the intended download directory. Attackers can overwrite ~/.penelope/peneloperc, which is loaded by Penelope and can lead to code execution on the operator's host. The maintainers fixed the issue in version 0.20.0.

Critical Impact
A compromised remote target can pivot back to the operator's workstation by writing arbitrary files outside the download directory, including the Penelope runtime configuration.

Affected Products

Penelope Shell Handler versions prior to 0.20.0
The vulnerable Unix download() implementation in penelope.py
Operator hosts running Penelope during post-exploitation engagements

Discovery Timeline

2026-07-29 - CVE-2026-50558 published to NVD
2026-07-29 - Last updated in NVD database
Fix released - Penelope v0.20.0 published on GitHub with the patched extraction routine

Technical Details for CVE-2026-50558

Vulnerability Analysis

Penelope is a Python-based shell handler used by operators to manage post-exploitation sessions. When an operator issues a download command against a Unix session, the remote side streams a tar archive back to the handler. The handler then calls tar.extractall(local_download_folder) to unpack it. Python's tarfile.extractall() does not, by default, validate that member paths remain inside the destination directory. Archive members can contain ../ sequences or absolute paths, which Python will honor during extraction.

Because the attacker controls the compromised endpoint that produces the archive, they control every member path in that archive. A malicious payload can write files to any location writable by the operator's user account.

Root Cause

The root cause is missing member-path validation before extraction. Safe tar handling requires resolving each member's final path and confirming it stays within the target directory before writing. The pre-0.20.0 code trusted archive contents implicitly, mapping directly to the CWE-22 Path Traversal weakness class.

Attack Vector

Exploitation requires the operator to initiate a download from a session the attacker controls, which satisfies the user interaction requirement in the CVSS vector. Once the operator triggers the download, the archive extraction writes attacker-chosen files to attacker-chosen locations. The highest-impact target is ~/.penelope/peneloperc, the Penelope run-command file. Overwriting this file allows the attacker to inject Penelope commands that execute the next time the operator launches the handler, effectively turning a captured shell into control of the tester's workstation.

python

# Patched version marker from penelope.py
# Source: https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62
__program__= "penelope"
-__version__ = "0.19.2"
+__version__ = "0.19.3"

import os
import io

Source: GitHub Commit a040afb. The commit updates the version string as part of the release that hardens download() against unsafe tar extraction.

Detection Methods for CVE-2026-50558

Indicators of Compromise

Unexpected modifications to ~/.penelope/peneloperc on operator workstations that run Penelope.
Files written outside the configured local_download_folder immediately after a Penelope download command.
Tar archives originating from remote sessions whose member names contain ../ sequences or absolute paths.

Detection Strategies

Enable filesystem auditing on ~/.penelope/ and the configured Penelope download directory to alert on writes from the python process executing penelope.py.
Compare the Penelope version reported by operators against the fixed release; any deployment below 0.20.0 should be treated as vulnerable.
Inspect captured tar archives from red-team engagements for entries with traversal patterns before running any extraction tooling.

Monitoring Recommendations

Log the full command line and working directory of Penelope processes launched by testers.
Monitor process creation on operator hosts for unexpected child processes spawned shortly after Penelope startup, which may indicate malicious peneloperc execution.
Track outbound sessions handled by Penelope and correlate download events with file creation activity outside the intended output directory.

How to Mitigate CVE-2026-50558

Immediate Actions Required

Upgrade Penelope to version 0.20.0 or later on every operator workstation.
Inspect ~/.penelope/peneloperc on hosts that ran vulnerable versions and reset the file to a known-good state if any download was performed against untrusted targets.
Run Penelope from a dedicated, non-privileged user account or an isolated virtual machine to limit blast radius during engagements.

Patch Information

The fix is available in Penelope v0.20.0. Details are documented in GitHub Security Advisory GHSA-f42x-p2mx-hm8r and the corresponding source commit. The patch validates tar member paths before extraction so archive entries cannot escape the download directory.

Workarounds

Avoid using the download feature against sessions on untrusted targets until the upgrade is applied.
Execute Penelope inside a disposable container or VM so that any file overwrite is contained and reverted between engagements.
Manually inspect tar archives with tar -tvf before extraction and reject any archive containing ../ or absolute paths.

bash

# Upgrade Penelope to the fixed release
pip install --upgrade 'penelope-shell>=0.20.0'

# Verify installed version
python -c "import penelope; print(penelope.__version__)"

# Audit the Penelope run-command file for tampering
ls -l ~/.penelope/peneloperc
sha256sum ~/.penelope/peneloperc