Listen to this Post
The vulnerability resides in the `handleSymlink` function within the archive extraction logic. When processing a symbolic link entry from a tar or deb archive, the function incorrectly swaps the order of its arguments. Instead of receiving (linkpath, target), it receives (target, linkpath). This causes the symlink’s target path to be misinterpreted as the intended location for the symlink file itself. Consequently, the symlink is created at the target’s path location. Combined with a lack of validation that the resolved symlink target remains within the designated extraction directory, a malicious archive can contain a symlink entry with a target like ../../../etc/passwd. The flawed function will then attempt to create the symlink file at that absolute or traversing path outside the extraction sandbox, leading to an arbitrary file write primitive.
DailyCVE Form
Platform: malcontent
Version: 1.8.0-1.20.2
Vulnerability: Symlink Path Traversal
Severity: Moderate
Date: 2026-01-29
Prediction: Patched 2026-01-29
What Undercode Say:
Crafting a malicious tar archive for testing ln -s /etc/passwd malicious-link tar --format=gnu --owner=0 --group=0 -cvf exploit.tar malicious-link Example of a vulnerable extraction call malcontent --scan ./exploit.tar
How Exploit:
- Attacker creates a tar archive with a symlink entry pointing to a sensitive target (e.g.,
../../.ssh/authorized_keys). - Victim uses a vulnerable version of `malcontent` to scan or extract this archive.
- The `handleSymlink` function inverts arguments, placing the symlink file at the target path.
- If privileges allow, the symlink is created in an unintended location, potentially enabling file overwrite when data is written through it.
Protection from this CVE
Update to version 1.20.3.
Impact:
Arbitrary File Write
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
