Archive extraction path-traversal exposure
Archive handling deserves its own trust boundary. The recurring defensive pattern is to validate canonical output paths before writing, not merely to filter suspicious-looking names.
- Original severity
- P2 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Product / surface
- CMR Search API archive upload handling
- Weakness
- Improper path restriction during archive extraction · CWE-22
- Affected boundary
- Unauthenticated archive-processing path
- Disclosure date
- 2026-04-16
- Public status checked
- 2026-09-10
- Public attribution
- obaskly
What the evidence established
The public disclosure reports a benign file-write confirmation outside the intended extraction location.
Why the impact was credible
The source reported an arbitrary-file-write condition that could increase compromise risk depending on the service environment.
Durable engineering lesson
Archive handling deserves its own trust boundary. The recurring defensive pattern is to validate canonical output paths before writing, not merely to filter suspicious-looking names.
Control pattern
Canonicalize every archive entry, reject paths outside a dedicated extraction root, and extract with least privilege.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.