BREAKING: CVE-2026-74764 - Pandora TAR Extraction Can Write Outside the Analysis Directory

TL;DR: Pandora, the open-source file-analysis framework operated by CIRCL, is vulnerable to a TAR archive path traversal that can write attacker-controlled files outside the intended extraction directory. Pandora versions through 1.12.5 passed archive member names directly to Python's tarfile.TarFile.extract() without an extraction filter. A crafted TAR containing ../ paths, absolute paths, or unsafe links can overwrite files accessible to the Pandora worker process. The CVE record scores the issue 10.0 Critical under CVSS 4.0. The upstream fix is commit 186b58d41e04248a154d274fffb5813e7fa2012e, which enables Python's filter='data' protection. At publication time, Pandora's latest tagged release is still v1.12.5, so operators should deploy a build containing the fix or block TAR submissions until a patched release is available.

What happened

Pandora is designed to accept suspicious files and run them through analysis workers. That trust model makes archive extraction especially sensitive: archive filenames are attacker-controlled by definition.

In affected releases, Pandora iterated over TAR members and called tar.extract(tarinfo, dest_dir). Without an extraction filter, a malicious member name can point outside dest_dir. Examples include parent-directory traversal such as ../../some/path, absolute paths, and unsafe archive links.

The upstream patch is intentionally small. Pandora now calls tar.extract(tarinfo, dest_dir, filter='data'). Python's data extraction filter rejects or sanitizes dangerous members that would escape the destination directory or abuse unsafe link targets.

Why the impact is critical

The CVE record assigns CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L, which evaluates to 10.0 Critical. Exploitation is network reachable, requires no privileges, has low complexity, and requires no user interaction when an exposed Pandora deployment accepts files for analysis.

The exact post-exploitation impact depends on the Pandora worker's filesystem permissions. A successful archive can overwrite application files, configuration, task data, or other files writable by the worker. If the attacker can replace code or configuration that Pandora later loads, the path traversal can become application compromise or code execution.

This is a particularly important failure mode for security tooling. Pandora exists to process hostile files safely. A malformed archive turning the analyzer itself into the target breaks the security boundary operators rely on when they submit untrusted samples.

Affected versions and patch status

The official CVE record marks Pandora versions up to and including 1.12.5 as affected. GitHub currently lists v1.12.5, released August 5, 2026, as the latest tagged release. The security fix landed afterward in upstream commit 186b58d41e04248a154d274fffb5813e7fa2012e.

That means a simple upgrade to the latest tagged release is not sufficient at the time of writing. Confirm that your deployed build contains the patch before reopening TAR analysis to untrusted users.

What to do

Source-based deployments: update to an upstream revision that contains the fix and verify the commit is present before restarting workers:

git fetch origin
git checkout main
git pull --ff-only
git merge-base --is-ancestor 186b58d41e04248a154d274fffb5813e7fa2012e HEAD   && echo "CVE-2026-74764 fix present"

If you maintain a pinned branch and cannot move to current main, review and cherry-pick the one-line upstream fix through your normal change-control process:

git cherry-pick 186b58d41e04248a154d274fffb5813e7fa2012e

Until a patched build is deployed, block TAR archive submissions at the upload boundary or route them to an isolated service that cannot write to application code, secrets, or host configuration. Treat filesystem sandboxing as defense in depth, not a substitute for the extraction fix.

After patching, inspect the worker's writable directories for unexpected files and review analysis submissions containing TAR archives. If the Pandora worker can write into application directories, consider integrity-checking the deployment against a known-good build.

Related Pandora decompression DoS

A second same-day issue, CVE-2026-74767, affects Pandora through 1.12.5. DAA archive extraction used unbounded zlib.decompress(), allowing a small compressed input to expand into enough data to exhaust memory and CPU. That issue is scored 8.7 High under CVSS 4.0 and is fixed by upstream commit f4294a873f86fbf2569c289e329fff2f52ca50c9, which adds bounded decompression and cumulative-size checks.

Operators rebuilding Pandora for CVE-2026-74764 should include both fixes before restoring untrusted archive processing.

References

• Official CVE record for CVE-2026-74764
• Pandora upstream TAR extraction fix
• Pandora source repository
• Pandora v1.12.5 release
• Official CVE record for CVE-2026-74767
• Pandora DAA decompression fix
• HOL Guard CVE evidence page