CVE-2026-74764 is a path traversal vulnerability (CWE-22) in the pandora-analysis pandora product affecting versions up to and including 1.12.5. The vulnerability occurs because the TAR archive extraction functionality does not apply any extraction filter when processing archive member names, allowing attacker-controlled paths with '../' sequences or absolute paths to write files outside the intended extraction directory. This can lead to overwriting files accessible to the Pandora worker process, potentially resulting in application compromise, arbitrary code execution, or denial of service. The vulnerability is mitigated by using Python's filter='data' extraction filter, which rejects or sanitizes unsafe TAR members and link targets.

An attacker who can submit a specially crafted TAR archive may cause files to be extracted outside the intended directory, overwriting arbitrary files accessible to the Pandora process. This can lead to application compromise, arbitrary code execution, or denial of service depending on the files overwritten and the privileges of the Pandora worker process. The vulnerability has a CVSS 4.0 score of 10.0 (critical), indicating a high-impact remote attack with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is corrected by applying Python's filter='data' extraction filter during TAR extraction, which sanitizes dangerous paths. Users should monitor the vendor for an official fix or update that implements this mitigation. Until then, avoid processing untrusted TAR archives or apply manual filtering of archive member paths before extraction.