THREAT OPS › Threat News › [NVD] CVE-2026-74764 — Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter.
An attacker able
[NVD] CVE-2026-74764 — Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter. An attacker able
CVE-2026-74764 CVSS: None Published: 2026-08-15T22:16:55.563
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter.
An attacker able to submit a specially crafted TAR archive containing mal
Indicators of compromise
- CVE-2026-74764cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-74764