CVE-2026-88069

CVE-2026-88069 is a path traversal vulnerability (CWE-22) in Pandora's archive extraction worker: when the worker unpacks a submitted archive or disk image, attacker-controlled file paths are used without verifying that the resolved destination stays within the intended extraction directory. An attacker who can submit a crafted file for analysis can use traversal sequences to write extracted content outside the designated directory and overwrite files accessible to the Pandora worker process; the CVSS 4.0 vector (network attack vector, no privileges or user interaction required) indicates a network-reachable submission path. Successful exploitation can lead to unauthorized modification of application or system files, denial of service, and potentially further compromise depending on the worker process's privileges and which files can be overwritten. Organizations running Pandora — described in the advisory as a platform that accepts file submissions for analysis — are affected; the advisory data does not name a vendor or specify affected or fixed versions. There is no evidence of exploitation in the wild (not listed in CISA KEV) and no public proof-of-concept is known; the fix resolves each extraction destination path before writing and rejects writes that resolve outside the expected directory.

What to do: Update Pandora to a build that resolves each extraction destination path before writing and rejects writes resolving outside the extraction directory; the advisory data does not name a fixed version, so consult the vendor or project's release notes to identify the patched release. Until patched, restrict who can submit files for analysis, run the Pandora worker with least privilege inside a sandboxed or containerized environment with only a narrow writable directory, and monitor for unexpected file modifications outside the extraction directory. After upgrading, review logs for reported path traversal attempts on previously submitted files.