CVE-2026-90445 in Malcolm
Summary
by MITRE • 09/12/2026
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process. This could allow an attacker to inject fabricated records into the system's stored data or tamper with application configuration.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability described constitutes a classic Path Traversal flaw within the file upload and archive processing subsystem, specifically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This security defect arises from an insufficient validation mechanism during the extraction phase of archived files. While the application correctly authenticates users before accepting uploads, it fails to enforce strict boundary checks on the file paths contained within those archives. When the system processes these archives, it extracts entries without verifying that the resulting destination path remains confined to the designated upload directory or any other intended safe zone. This oversight allows an attacker to manipulate archive metadata, such as ZIP central directory records, to include relative path sequences like dot-dot-slash (../) or absolute paths pointing outside the restricted context.
From a technical perspective, this flaw exploits the lack of canonicalization and normalization checks on file system operations. Modern operating systems resolve symbolic links and relative path components before performing write actions. By crafting an archive with entries that traverse up the directory hierarchy using these sequences, the attacker forces the extraction utility to bypass the sandboxed environment. The application then proceeds to write files to arbitrary locations determined by the crafted paths. Because this process occurs under the privileges of the running service account or user context, the impact is significantly amplified compared to a scenario where permissions are strictly limited. This behavior aligns with ATT&CK technique T1505.003: Web Shell, as it enables the placement of malicious files in locations that may be accessible via web requests, although its scope extends beyond just web shells to include data injection and configuration tampering.
The operational impact of this vulnerability is severe due to the potential for both confidentiality and integrity compromises. An attacker can inject fabricated records into system databases or log files if they target database storage directories or logging paths. This could lead to data corruption, false audit trails, or manipulation of business logic that relies on these stored records. Furthermore, tampering with application configuration files is a critical risk. By overwriting configuration files located outside the upload directory, an attacker can alter authentication mechanisms, disable security controls, redirect database connections, or inject malicious code into startup scripts. This level of control effectively grants the attacker persistent access and the ability to escalate privileges within the system environment, potentially leading to full system compromise if combined with other vulnerabilities such as command injection in configuration parsers.
Mitigation strategies must focus on implementing robust input validation and secure file handling practices at both the application logic and operating system levels. The primary defense is to enforce strict allow-listing of allowed characters in filenames and to validate that every extracted path resolves to a location within the intended directory using canonicalization techniques before any write operation occurs. Developers should utilize standard library functions that safely resolve paths, ensuring that symbolic links are not followed or are explicitly handled with caution. Additionally, running the extraction process under a restricted user account with minimal permissions can limit the blast radius of such an attack. Implementing file type validation and scanning archives for malicious content prior to extraction adds another layer of defense. Finally, monitoring file system changes in sensitive directories can aid in early detection of unauthorized writes resulting from this vulnerability.