CVE-2026-74764 is a path traversal vulnerability (CWE-22) in the pandora-analysis pandora product affecting versions up to and including 1.12.5. The vulnerability occurs during TAR archive extraction where member names are passed directly to Python's tarfile.TarFile.extract() without applying an extraction filter. An attacker submitting a specially crafted TAR archive with malicious paths (e.g., '../' sequences or absolute paths) can cause files to be extracted outside the intended directory, potentially overwriting critical files accessible to the Pandora worker process. This could lead to application compromise, arbitrary code execution, or denial of service depending on the privileges of the process and the files targeted. The vulnerability is mitigated by using Python's filter='data' extraction filter, which rejects or sanitizes unsafe TAR members and link targets.

An attacker can exploit this vulnerability by submitting a malicious TAR archive that causes files to be extracted outside the intended directory. This may allow overwriting of files accessible to the Pandora worker process, potentially leading to application compromise, arbitrary code execution, or denial of service. The severity is critical with a CVSS 4.0 score of 10.0, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is corrected by applying Python's filter='data' extraction filter during TAR extraction to sanitize dangerous archive members. Until an official fix is available, avoid processing untrusted TAR archives or implement custom filtering to prevent path traversal.