PT-2026-5354 · Unknown · Malcontent

1Seal · CVE-2026-24846 · Published 2026-01-29 · Updated 2026-02-24

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions malcontent versions 1.8.0 through 1.20.2

Description malcontent may allow for the creation of symlinks outside the intended extraction directory when scanning specially crafted tar or deb archives. This occurs because the handleSymlink function received arguments in the incorrect order, leading to the symlink target being used as the symlink location. Additionally, symlink targets were not validated to ensure they remained within the extraction directory.

Recommendations Update to version 1.20.3 or later to benefit from the fixes that swap the handleSymlink function arguments, validate the symlink location, and validate that symlink targets resolve within the extraction directory.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-683

Related Identifiers

CVE-2026-24846

GHSA-923J-VRCG-HXWH

GO-2026-4391

SUSE-SU-2026:0403-1

Affected Products

Malcontent

References · 90

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24846.json · Exploit
• https://github.com/chainguard-dev/malcontent/commit/259fca5abc004f3ab238895463ef280a87f30e96 · Patch
• https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-923j-vrcg-hxwh · Vendor Advisory
• https://github.com/chainguard-dev/malcontent/commit/a7dd8a5328ddbaf235568437813efa7591e00017 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24846 · Security Note
• https://osv.dev/vulnerability/GO-2026-4391 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-923j-vrcg-hxwh · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24846 · Vendor Advisory
• https://github.com/chainguard-dev/malcontent · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2023-43630 · Note
• https://suse.com/security/cve/CVE-2026-23954 · Note
• https://suse.com/security/cve/CVE-2026-24740 · Note
• https://suse.com/security/cve/CVE-2026-25499 · Note