Path Traversal Vulnerability in Pandora by Pandora Analysis

CVE-2026-74764

What is CVE-2026-74764?

Pandora suffers from a path traversal vulnerability in its TAR archive extraction process. This flaw arises when the extractor handles TAR members insecurely, allowing an attacker to craft a malicious TAR archive with paths that mislead the extraction mechanism. By using techniques such as '../' sequences or absolute paths, an attacker can manipulate the extraction to write files outside the designated directory. As a result, there is potential for overwriting critical files linked to the Pandora process or, worse, triggering arbitrary code execution or denial of service based on the specific targets chosen and the privileges of the process. The issue has been mitigated by implementing an extraction filter that sanitizes and rejects unsafe TAR member paths, maintaining the integrity and security of the application.

References