VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Mar 20, 2026· Updated Apr 16, 2026

CVE-2026-32771

CVE-2026-32771

Description

The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). In versions prior to 0.2.2, the sanitizeArchivePath function in pkg/extract/extract.go (lines 248–254) is vulnerable to Path Traversal due to a missing trailing path separator in the strings.HasPrefix check. The extractor allows arbitrary file writes (e.g., overwriting shell configs, SSH keys, kubeconfig, or crontabs), enabling RCE and persistent backdoors. The attack surface is further amplified by the default ReadWriteMany PVC access mode, which lets any pod in the cluster inject a malicious payload. This issue has been fixed in version 0.2.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/ctfer-io/monitoringGo
< 0.2.20.2.2

Affected products

1

Patches

1
269dba165aa4

fix: missing check on archive path sanitization (#169)

https://github.com/ctfer-io/monitoringLucas TessonMar 14, 2026via ghsa
commit
1 file changed · +6 −5
  • pkg/extract/extract.go+6 −5 modified
    @@ -245,12 +245,13 @@ func untar(r io.Reader, dest string) error {
 	return nil
 }
 
-func sanitizeArchivePath(d, t string) (v string, err error) {
-	v = filepath.Join(d, t)
-	if strings.HasPrefix(v, filepath.Clean(d)) {
-		return v, nil
+// Based upon https://security.snyk.io/research/zip-slip-vulnerability#expandable-socPI9fFAJ-title
+func sanitizeArchivePath(destination, filePath string) (destpath string, err error) {
+	destpath = filepath.Join(destination, filePath)
+	if !strings.HasPrefix(destpath, filepath.Clean(destination)+string(os.PathSeparator)) {
+		return destpath, fmt.Errorf("filepath is tainted: %s", destination)
 	}
-	return "", fmt.Errorf("filepath is tainted: %s", t)
+	return
 }
 
 func ptr[T any](t T) *T {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

50