The Open edX Platform's extract_archive.py module used a flawed method (_is_bad_path) to validate extraction paths by comparing resolved path strings with startswith instead of properly validating path components. This allowed a course author or staff user with course import permission to submit a crafted .tar.gz archive via the import_olx flow that could escape the intended extraction directory and write files into sibling course staging directories sharing a base64 prefix. Zip archives are not affected due to ZipFile.extractall's internal protections. The vulnerability is fixed in Ulmo and Verawood.1 versions.

An attacker with course import permissions can cause limited cross-tenant file corruption by escaping the intended extraction directory during archive import. There is no evidence of arbitrary filesystem writes beyond sibling directories, no file reads, and no direct code execution. The impact is limited to integrity issues within the course staging environment.

This vulnerability is fixed in Ulmo and Verawood.1 versions of openedx-platform. Users should upgrade to these or later versions to remediate the issue. No additional mitigation is required if these versions are in use. Patch status is confirmed fixed in these versions.