Pandora Analysis up to 1.12.7 Archive Extraction path traversal

Summaryinfo

A vulnerability categorized as critical has been discovered in Pandora Analysis Pandora up to 1.12.7. Affected is an unknown function of the component Archive Extraction. Such manipulation leads to path traversal. This vulnerability is documented as CVE-2026-88069. The attack can be executed remotely. There is not any exploit available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Pandora Analysis Pandora up to 1.12.7. Affected by this issue is an unknown functionality of the component Archive Extraction. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker able to submit a malicious file for analysis could use path traversal sequences or crafted paths to cause extracted content to be written outside the designated extraction directory, potentially overwriting files accessible to the Pandora worker process. Successful exploitation could result in unauthorized modification of application or system files, denial of service, and potentially further compromise depending on the permissions of the Pandora process and the files that can be overwritten. The vulnerability is addressed by resolving each extraction destination path before writing and verifying that it remains below the expected extraction directory. Extraction attempts resolving outside this directory are rejected and reported as path traversal attempts.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-88069 since 09/09/2026. The exploitation is known to be easy. The attack may be launched remotely. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

Applying the patch d86ac5b260fb9a41e07f1da1bbd326cdcfc188a7 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Pandora Analysis

Name

• Pandora

Version

• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.12.5
• 1.12.6
• 1.12.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion