---
id: CVE-2026-90445
title: >-
  An interface that accepts file uploads from authenticated users extracts the
  contents of uploaded archives without validating that extracted file paths
  remain within the intended destination directory
summary: >-
  An interface that accepts file uploads from authenticated users extracts the
  contents of uploaded archives without validating that extracted file paths
  remain within the intended destination directory. This allows an authenticated
  attack…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-22
vendor: CISA
product: Malcolm
affected:
  - Malcolm < v26.06.0
published: '2026-09-11'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T22:16:54.923'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90445'
references:
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01'
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T12:50:19.067892Z'
epss: 0.00326
epssPercentile: 0.25575
scores:
  nvd: 6.5
  cna: 7.1
ingestedAt: '2026-09-14T15:23:07.429Z'
---

## Overview

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process. This could allow an attacker to inject fabricated records into the system's stored data or tamper with application configuration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.