CVE-2026-63347: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-63347 is a path traversal vulnerability in suricata-update (the rule management tool for the Suricata IDS/IPS engine) that allows an attacker to write arbitrary files outside the configured rules directory. The flaw exists in versions prior to 1.3.8 of the suricata-update pip package. It was published on July 21, 2026, by the Open Information Security Foundation (OISF) and carries a CVSS v3.1 base score of 8.1 (High) (GHSA-6v4p-4w5x-9fp2).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). When suricata-update processes downloaded rule archives (tar or zip), its embedded-file handling for rule keywords such as lua, filemd5, filesha1, and filesha256 does not validate or sanitize destination paths. A malicious archive can include members with ../ sequences in their paths, causing suricata-update to write attacker-controlled file content to arbitrary locations on the filesystem outside the intended rules directory (GHSA-6v4p-4w5x-9fp2).

Successful exploitation allows an unauthenticated remote attacker (via a malicious ruleset archive) to write arbitrary files anywhere on the filesystem that the suricata-update process has write access to. If run as root — a common deployment pattern — this could result in full system compromise through overwriting critical system files, planting backdoors, or achieving privilege escalation. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High (GHSA-6v4p-4w5x-9fp2).

The CVE is currently in Reserved status with no public reports of in-the-wild exploitation or known exploit kits. The attack vector is Network with High complexity, requiring no privileges or user interaction, but the attacker must be able to serve or inject a malicious rule archive that suricata-update fetches and processes. No EPSS score or CISA KEV catalog entry has been identified at this time (GHSA-6v4p-4w5x-9fp2).

1. Craft a malicious archive: Create a tar or zip rule archive containing one or more files with path-traversal sequences in their names (e.g., ../../etc/cron.d/backdoor or ../../root/.ssh/authorized_keys) and attacker-controlled content.
2. Host the archive: Serve the malicious archive from an attacker-controlled server or perform a man-in-the-middle attack on an existing ruleset source to substitute a legitimate archive with the malicious one.
3. Trigger suricata-update: Wait for or induce the target system to run suricata-update, which fetches and processes the malicious archive. This may occur automatically via a scheduled cron job.
4. Achieve arbitrary file write: suricata-update extracts the archive without sanitizing paths, writing attacker-controlled content to the traversed destination (e.g., a cron job, SSH authorized key, or web shell).
5. Escalate or persist: If suricata-update ran as root, the written file (e.g., a cron entry or SSH key) grants the attacker persistent access or code execution on the host (GHSA-6v4p-4w5x-9fp2).

• File System: Unexpected files created outside the Suricata rules directory (e.g., /etc/suricata/rules/) with timestamps correlating to suricata-update execution; new or modified files in sensitive directories such as /etc/cron.d/, /root/.ssh/, /etc/passwd, or web-accessible paths.
• Logs: suricata-update logs showing extraction of archive members with ../ in their paths; unexpected file write errors or successes in system logs around the time of a suricata-update run.
• Process: suricata-update process spawning unexpected child processes or making outbound connections to unfamiliar IP addresses to fetch rule archives.
• Network: HTTP/HTTPS requests from the Suricata host to unfamiliar or newly registered domains serving .tar.gz or .zip files (GHSA-6v4p-4w5x-9fp2).

Upgrade suricata-update to version 1.3.8 or later, which patches the path traversal issue. Users running Suricata with the bundled suricata-update should upgrade to Suricata 8.0.6 or 7.0.17, which include the fixed version. As an immediate workaround, avoid running suricata-update as root — use a dedicated, least-privilege account as described in the Suricata documentation. Additionally, only consume rule archives from trusted, verified sources (GHSA-6v4p-4w5x-9fp2).

The vulnerability was reported by security researcher Guillem Lefait and disclosed by OISF maintainer jasonish via a GitHub Security Advisory on July 21, 2026. No significant broader media coverage or notable social media discussion has been identified at this time (GHSA-6v4p-4w5x-9fp2).