CVE-2026-24846: 
NixOS vulnerability analysis and mitigation

CVE-2026-24846 is a path traversal vulnerability in Chainguard's malcontent, a supply-chain compromise detection tool, that allows an attacker to create symlinks outside the intended extraction directory when a user scans a specially crafted tar or deb archive. The flaw affects malcontent versions 1.8.0 through 1.20.2 and was disclosed on January 29, 2026. It carries a CVSS v3.1 base score of 5.5 (Moderate) (Github Advisory, Chainguard Advisory). The vulnerability was discovered and reported by Oleh Konko from 1seal (Github Advisory).

The root cause is a combination of CWE-683 (Function Call With Incorrect Order of Arguments) and CWE-22 (Path Traversal). The handleSymlink function in pkg/archive/archive.go was called with its linkPath and linkTarget arguments swapped, causing the symlink target value to be used as the symlink's filesystem location. Additionally, no validation was performed to ensure that symlink targets resolved within the extraction directory, allowing relative paths such as ../../etc/passwd to escape the sandbox. The attack requires local access and user interaction — specifically, a user must be induced to scan a maliciously crafted tar or deb archive with a vulnerable version of malcontent (Chainguard Advisory, Patch Commit a7dd8a5).

Successful exploitation allows an attacker to create arbitrary symlinks at locations outside the intended extraction directory, which can lead to unauthorized file writes on the host system. An attacker could overwrite critical system files, configuration files, or application binaries, compromising system integrity. There is no confidentiality or availability impact; the impact is limited to integrity (CVSS Integrity: High) (Github Advisory, Chainguard Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.007% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory).

1. Craft a malicious archive: Create a tar or deb archive containing a symlink entry where the symlink's target path uses directory traversal sequences (e.g., ../../etc/cron.d/backdoor) to point outside the intended extraction directory.
2. Deliver the archive: Distribute the crafted archive to a target who uses malcontent for scanning — for example, by hosting it in a package repository, CI/CD pipeline artifact store, or via social engineering.
3. Trigger scanning: Induce the victim to scan the malicious archive using a vulnerable version of malcontent (1.8.0–1.20.2). This can occur as part of automated supply-chain analysis workflows.
4. Symlink created outside extraction directory: Due to the swapped handleSymlink arguments and lack of target validation, malcontent creates a symlink at the attacker-controlled path outside the extraction directory (e.g., /etc/cron.d/backdoor -> /tmp/malicious_script).
5. Achieve arbitrary file write: If the symlink target is subsequently written to by the system or another process, the attacker achieves an arbitrary file write, potentially enabling persistence or privilege escalation (Chainguard Advisory, Patch Commit a7dd8a5).

• File System: Unexpected symlinks created outside the malcontent extraction/temp directory (e.g., in /etc/, /usr/, or other system directories) pointing to attacker-controlled paths; symlinks with traversal patterns in their names or targets (e.g., containing ../).
• Logs: System or application logs showing malcontent scanning a tar or deb archive from an untrusted or unexpected source; file system audit logs (e.g., auditd) recording symlink creation (symlink syscall) outside expected temp directories by the malcontent process.
• Process: Unexpected file system modifications (symlink creation) originating from the malcontent process (malcontent binary) in directories outside its designated temp/extraction path.

Upgrade malcontent to version 1.20.3 or later, which fixes the issue by swapping the handleSymlink function arguments and adding validation to ensure both symlink locations and targets resolve within the extraction directory (Chainguard Advisory, Patch Commit 259fca5). Until patching is possible, restrict malcontent usage to scanning archives from trusted sources only, and implement file integrity monitoring to detect unauthorized file modifications. Users should avoid scanning untrusted tar or deb archives with vulnerable versions.

The vulnerability was coordinated and published by the Chainguard security team (eslerm as coordinator) with remediation contributions from egibs, antitree, and stevebeattie. The issue was reported by Oleh Konko from 1seal. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified (Chainguard Advisory).