Malcolm's safe-extract.py script, before version 26.07.0, improperly handles directory creation during archive extraction by using os.makedirs on paths constructed from archive entries without validating or sanitizing path traversal sequences. Although libarchive's secure flags are used, the raw os.makedirs call allows malicious archives containing '../' or absolute paths to cause directory creation outside the intended extraction directory, leading to potential unauthorized file system modifications. The vulnerability is resolved in version 26.07.0.

The vulnerability allows an attacker who can upload a malicious archive to cause the filebeat processing container to create directories outside the intended extraction directory. This can lead to unauthorized modification of the file system, potentially impacting the integrity and availability of the affected system. Confidentiality impact is not indicated. The CVSS score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

Upgrade to Malcolm version 26.07.0 or later, where this path traversal vulnerability in safe-extract.py is fixed. No other mitigation is indicated or required by the vendor advisory. Patch status is not explicitly confirmed beyond the version fix; check the vendor advisory for the latest remediation guidance.