CVE-2026-74764

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter. An attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extracted files to be written outside the intended extraction directory. This may allow the attacker to overwrite files accessible to the Pandora worker process and could potentially result in application compromise, arbitrary code execution, or denial of service depending on the files targeted and the privileges of the Pandora process. The vulnerability is corrected by using Python's filter='data' extraction filter, which rejects or sanitizes dangerous TAR members, including paths that escape the destination directory and unsafe link targets. The weakness corresponds to MITRE's general path traversal category, which includes archive extraction cases where attacker-controlled filenames cause files to be written outside the intended directory.

• CWE-22

• https://github.com/pandora-analysis/pandora/commit/186b58d41e04248a154d274fffb5813e7fa2012e

Published

Aug 15, 2026

Last Modified

Aug 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-74757Uncontrolled resource allocation in the mcpack2pb component …7.5
• CVE-2026-74758A heap use-after-free in the RTMP protocol component of Apac…7.5
• CVE-2026-74759Google::Auth versions 0.12 for Perl allow server side reques…9.8
• CVE-2026-7476Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel D…7.8
• CVE-2026-74760Google::Auth versions from 0.11 through 0.12 for Perl accept…8.8
• CVE-2026-74761Improper input validation in TopicRegion in Apache ActiveMQ,…7.5
• CVE-2026-74765Net::IDN::Punycode versions before 2.590 for Perl allow an o…6.5
• CVE-2026-74766Net::IDN::Punycode versions from 2.301 before 2.590 for Perl…8.4
• CVE-2026-74767Pandora contains a denial-of-service vulnerability in its ha…8.7
• CVE-2026-74768Dell PowerProtect Data Manager, versions 20.2.0.0 and below,…4.1
• CVE-2026-74769Dell PowerProtect Data Manager, versions 20.2.0.0 and below,…6.5
• CVE-2026-7477Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel D…7.8