---
id: CVE-2026-90445
title: >-
  An interface that accepts file uploads from authenticated users extracts the
  contents of uploaded archives without validating that extracted file paths
  remain within the intended destination directory
summary: >-
  An interface that accepts file uploads from authenticated users extracts the
  contents of uploaded archives without validating that extracted file paths
  remain within the intended destination directory. This allows an authenticated
  attack…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
vendor: CISA
product: Malcolm
affected:
  - Malcolm < v26.06.0
published: '2026-09-11'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:40:31.053'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90445'
references:
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
  - cve.org
epss: 0.00347
epssPercentile: 0.28415
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T12:50:19.067892Z'
cvssSource: cna
ingestedAt: '2026-09-14T15:23:07.429Z'
---

## Overview

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process. This could allow an attacker to inject fabricated records into the system's stored data or tamper with application configuration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.