CVE-2026-63134 cisagov CVE debrief

Who should care

Defenders responsible for Malcolm installations should assess exposure and prioritize upgrading to version 26.07.0 or later. They should also review their container configurations and monitor for suspicious directory creation. Operators of Malcolm installations, as well as security and vulnerability management teams, should be aware of the potential for directory traversal and take steps to mitigate the vulnerability.

Why it matters

CVE-2026-63134 is a medium-severity vulnerability in the Malcolm network traffic analysis tool suite that allows for directory traversal. Defenders should prioritize verifying if their installations are vulnerable and upgrading to version 26.07.0 or later. They should also review their container configurations and monitor for suspicious directory creation.

• Potential for directory traversal and unauthorized directory creation
• Need to verify if Malcolm installations are vulnerable and upgrade to version 26.07.0 or later
• Monitoring for suspicious directory creation is necessary

Technical summary

The `safe-extract.py` script in Malcolm creates directory entries without proper traversal protection, allowing an uploaded malicious archive to create directories outside the intended extraction directory. This vulnerability can be exploited by uploading a malicious archive containing a directory entry with a `../` sequence or an absolute path. The issue was fixed in version 26.07.0 by implementing proper traversal protection. Defenders should prioritize verifying if their Malcolm installations are vulnerable and upgrading to the fixed version.

Defensive priority

Defenders should prioritize verifying if their Malcolm installations are vulnerable and upgrading to version 26.07.0 or later. They should also review their container configurations and monitor for suspicious directory creation.

Recommended defensive actions

• Verify if the Malcolm installation is vulnerable and upgrade to version 26.07.0 or later
• Review container configurations to prevent directory traversal
• Monitor for suspicious directory creation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but do not specify if any versions prior to 26.07.0 are affected or if there are any known exploits. The `safe-extract.py` script in Malcolm creates directory entries without proper traversal protection, allowing an uploaded malicious archive to create directories outside the intended extraction directory. Defenders should verify if their installations are vulnerable and review container configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.