Path Traversal Vulnerability in CTFer.io Monitoring Component
CVE-2026-32771

8.8HIGH

Key Information:

Vendor

Ctfer-io

Status
Monitoring
Vendor
CVE Published:
20 March 2026

What is CVE-2026-32771?

The CTFer.io Monitoring component has a path traversal vulnerability that allows unauthorized file accesses and modifications. The sanitizeArchivePath function in versions before 0.2.2 suffers from a flaw due to a missing trailing path separator in checks. This makes it possible for an attacker to write arbitrary files, potentially leading to overwriting critical system configurations such as shell configs, SSH keys, and kubeconfig files. The situation is exacerbated by the default ReadWriteMany PVC access mode, which provides a wider attack vector for abuse within the cluster. This vulnerability has been remediated in version 0.2.2.

Affected Version(s)

monitoring < 0.2.2

References

https://github.com/ctfer-io/monitoring/security/advisorie...
x_refsource_CONFIRM
https://github.com/ctfer-io/monitoring/commit/269dba165aa...
x_refsource_MISC
https://security.snyk.io/research/zip-slip-vulnerability#...
x_refsource_MISC

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.