CVE-2026-63134

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0

Description The safe-extract.py script fails to implement traversal protection when creating directory entries using the os.makedirs(os.path.join(dest, entry.pathname)) function. An attacker can upload a malicious archive containing an absolute path or a ../ sequence in a directory entry, which allows the filebeat processing container to create directories outside of the intended extraction path. Path traversal is a technique used to access files or directories that are outside the intended folder by using special characters like ../ to move up the directory hierarchy.

Recommendations Update to version 26.07.0.