CVE-2026-24846

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-24846
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24846.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-24846
Aliases
Published
2026-01-29T21:12:18.991Z
Modified
2026-02-05T20:48:33.824467Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
malcontent's archive extraction could write outside extraction directory
Details

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The handleSymlink function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory.

Database specific 
{
    "cwe_ids": [
        "CWE-22",
        "CWE-683"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24846.json"
}
References

Affected packages

Git / github.com/chainguard-dev/malcontent

Affected ranges

Type
GIT
Repo
https://github.com/chainguard-dev/malcontent
Events
Introduced
a7e559c2e2c12e80dc4a308a96d2985f2853ceaa
Fixed
96faed538d6fdd5fc27e4a9b9ecff5385325ce54

Affected versions

v1.*
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.12.2
v1.13.0
v1.13.1
v1.14.0
v1.14.1
v1.15.0
v1.15.1
v1.16.0
v1.16.1
v1.16.2
v1.16.3
v1.16.4
v1.16.5
v1.16.6
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.18.0
v1.18.1
v1.18.2
v1.18.3
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.20.0
v1.20.1
v1.20.2
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24846.json"