CVE-2026-63134: medium-severity vulnerability in cisagov Malcolm
Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
cisagov · MalcolmRelated CVEs — cisagov Malcolm
In the same product, most dangerous first.
CVE-2026-55676HIGHMalcolm vulnerable to RCE via unrestricted .php upload to the file-upload componentEPSS 0.6%CVE-2026-63133HIGHMalcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)EPSS 0.5%CVE-2026-63177HIGHMalcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBACEPSS 0.4%