CVE-2026-63134: Malcolm Path Traversal Vulnerability

CVE-2026-63134 Overview

CVE-2026-63134 is a path traversal vulnerability in Malcolm, a network traffic analysis tool suite maintained by CISA. The flaw resides in the safe-extract.py script used by the filebeat processing container. While libarchive secure flags protect file extraction, the script creates directory entries using an unprotected os.makedirs(os.path.join(dest, entry.pathname)) call. An authenticated attacker who uploads a crafted archive with ../ sequences or absolute paths in directory entries can cause directories to be created outside the intended extraction target. The issue is fixed in Malcolm version 26.07.0 and is tracked under [CWE-22].

Critical Impact
An authenticated attacker can create arbitrary directories outside the extraction path on the filebeat processing container, enabling filesystem manipulation and potential integrity or availability impact.

Affected Products

Malcolm network traffic analysis tool suite
Versions prior to 26.07.0
Filebeat processing container component (safe-extract.py)

Discovery Timeline

2026-08-11 - CVE-2026-63134 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-63134

Vulnerability Analysis

Malcolm ingests uploaded packet capture archives and processes them inside a filebeat container. The safe-extract.py helper uses libarchive to extract archive contents, and libarchive is configured with secure flags that block traversal during file writes. However, the script separately calls os.makedirs(os.path.join(dest, entry.pathname)) to pre-create directory entries. This call performs no normalization or sandboxing of entry.pathname.

When entry.pathname contains ../ sequences, os.path.join collapses relative segments and produces a path outside dest. When entry.pathname is absolute, os.path.join discards dest entirely and uses the attacker-supplied absolute path. Either case results in directory creation at attacker-controlled locations on the container filesystem.

Root Cause

The root cause is missing input validation on archive directory entries. The developer relied on libarchive secure flags for file operations but implemented a parallel directory-creation code path in Python that bypasses those protections. Trust in the archive metadata was not revalidated before invoking os.makedirs.

Attack Vector

Exploitation requires an authenticated user with permission to upload archives to Malcolm. The attacker crafts an archive containing a directory entry whose pathname field includes ../../../etc/target or an absolute path such as /var/lib/attacker. When Malcolm processes the upload, the filebeat container calls safe-extract.py, which creates the attacker-specified directory. Refer to the GitHub Security Advisory GHSA-65mm-vgrw-vqx4 for full technical details.

Detection Methods for CVE-2026-63134

Indicators of Compromise

Unexpected directories appearing outside the designated extraction path within the filebeat processing container
Archive uploads containing directory entries with ../ sequences or absolute path prefixes
Filesystem write activity by the filebeat container process to paths outside its normal working directories

Detection Strategies

Audit archive upload logs and correlate uploads with subsequent filesystem changes on the filebeat container
Inspect stored archives with tar -tvf or bsdtar -tvf and flag entries whose names contain .. or start with /
Monitor container runtime telemetry for mkdir or os.makedirs operations targeting paths outside expected extraction directories

Monitoring Recommendations

Enable filesystem integrity monitoring on the filebeat container and its bind-mounted volumes
Log all archive upload events with authenticated user identity for post-incident review
Alert on any process writes outside the configured extraction root within the Malcolm container stack

How to Mitigate CVE-2026-63134

Immediate Actions Required

Upgrade Malcolm to version 26.07.0 or later, which fixes the traversal in safe-extract.py
Review authentication and authorization controls to restrict archive upload permissions to trusted users only
Audit the filebeat container filesystem for directories created outside the expected extraction paths

Patch Information

Malcolm version 26.07.0 addresses this vulnerability. Details are available in the GitHub Malcolm Release v26.07.0 notes and the GitHub Security Advisory GHSA-65mm-vgrw-vqx4.

Workarounds

Restrict archive upload capability to a minimal set of trusted authenticated users until patching is complete
Validate archive contents out-of-band before ingestion and reject archives containing .. or absolute paths in entry names
Run the filebeat processing container with a read-only root filesystem and tightly scoped bind mounts to limit the impact of directory creation outside the extraction target

bash

# Inspect an archive for traversal or absolute-path entries before upload
bsdtar -tvf suspicious.tar | awk '{print $NF}' | grep -E '(^/|\.\./)'