GitHub Advisoryadvisory · Go

GHSA-923j-vrcg-hxwh malcontent vulnerable to symlink Path Traversal via handleSymlink argument confusion in archive extraction

MEDIUM Published 2026-01-29 Modified 2026-01-31 Official page ↗
Aliases
CVE-2026-24846
Ecosystem
Go
Packages
github.com/chainguard-dev/malcontent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-22, CWE-683
Reviewed
2026-01-29

Affected packages

• Go github.com/chainguard-dev/malcontent: >= 1.8.0, < 1.20.3 → fixed in 1.20.3

Description

malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Fixes: • Swap handleSymlink arguments; validate symlink location • Validate symlink targets resolve within extraction directory Acknowledgements Thank you to Oleh Konko from 1seal for discovering and reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-24846 malcontent discovers supply-chain compromises through. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-683 Function Call With Incorrect Order of Arguments weakness

References