CVE-2026-24846
📋 TL;DR
This vulnerability in malcontent allows attackers to create symbolic links outside the intended extraction directory when scanning specially crafted tar or deb archives. The bug occurs due to argument order reversal in the handleSymlink function and lack of symlink target validation. Users of malcontent versions 1.8.0 through 1.20.2 are affected.
💻 Affected Systems
- malcontent
📦 What is this software?
Malcontent by Chainguard
⚠️ Risk & Real-World Impact
Worst Case
An attacker could create symlinks to sensitive system files, potentially leading to arbitrary file read/write, privilege escalation, or system compromise if malcontent runs with elevated privileges.
Likely Case
Local file system manipulation allowing unauthorized access to files outside the extraction directory, potentially exposing sensitive data or enabling further attacks.
If Mitigated
Limited impact if malcontent runs with minimal privileges and only processes trusted archives from controlled sources.
🎯 Exploit Status
Exploitation requires crafting a malicious archive and convincing a user to scan it. No public exploits have been reported as of the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.20.3
Vendor Advisory: https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-923j-vrcg-hxwh
Restart Required: No
Instructions:
1. Update malcontent to version 1.20.3 or later using your package manager. 2. If building from source, pull the latest commit from GitHub. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Restrict archive sources
allOnly scan archives from trusted, verified sources to prevent exploitation.
Run with minimal privileges
linuxExecute malcontent with non-root privileges to limit potential damage from symlink attacks.
sudo -u nonprivilegeduser malcontent [options]
🧯 If You Can't Patch
- Discontinue use of malcontent for scanning untrusted archives
- Implement strict access controls on directories malcontent can access
🔍 How to Verify
Check if Vulnerable:
Check malcontent version: malcontent --version. If version is between 1.8.0 and 1.20.2 inclusive, the system is vulnerable.Check Version:
malcontent --versionVerify Fix Applied:
After updating, run malcontent --version and confirm version is 1.20.3 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual symlink creation during archive scanning
- Permission errors when accessing files outside expected directories
Network Indicators:
- N/A - local vulnerability
SIEM Query:
process.name="malcontent" AND file.path contains "symlink" AND file.path contains ".."