CVE-2026-88069 is a path traversal vulnerability (CWE-22) in the pandora-analysis pandora product's archive extraction worker. When processing specially crafted archives or disk images, attacker-controlled file paths can cause extracted content to be written outside the intended extraction directory. This occurs because the extraction process does not ensure the destination path remains within the restricted directory. Exploitation could allow overwriting of files accessible to the Pandora worker process, leading to unauthorized file modification, denial of service, or further system compromise depending on permissions. The vulnerability is mitigated by resolving each extraction destination path before writing and rejecting extraction attempts that resolve outside the expected directory. The vulnerability affects pandora versions <=1.12.7. No patch or official remediation level is currently documented.

Successful exploitation allows an attacker who can submit malicious files for analysis to write files outside the intended extraction directory. This can result in unauthorized modification of application or system files, denial of service, and potentially further compromise depending on the permissions of the Pandora worker process and the files that can be overwritten. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical impact with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is addressed by resolving extraction paths and rejecting those that escape the extraction directory, but no official fix or patch has been documented at this time. Users should monitor vendor communications for updates and apply any forthcoming patches promptly.