CVE-2026-74764

Name of the Vulnerable Software and Affected Versions Pandora (affected versions not specified)

Description Pandora contains a path traversal issue in its TAR archive extraction functionality. The extractor passes archive member names directly to the tarfile.TarFile.extract() function without applying an extraction filter. An attacker can submit a specially crafted TAR archive containing malicious member paths, such as absolute paths or sequences using ../, to write files outside the intended extraction directory. This can lead to the overwriting of files accessible to the Pandora worker process, potentially resulting in arbitrary code execution, application compromise, or denial of service.

Recommendations Apply the Python filter='data' extraction filter to reject or sanitize dangerous TAR members, including unsafe link targets and paths that escape the destination directory.