Pandora CVE-2026-74764 and 74767: archives escape directory and memory limits

CVE-2026-74764 and CVE-2026-74767 in the Pandora file-analysis platform were published on 15 August 2026. The first lets a malicious TAR archive write outside its extraction directory. The second uses DAA to expand a small compressed file into a huge in-memory ISO image. Together they demonstrate two boundaries every untrusted-file service must enforce: where output may be written and how much it may consume.

The path-traversal advisory scores 10.0 under CVSS 4.0, while the decompression-bomb advisory scores 8.7. Fix commits entered the project on 15 August, and the packaged Pandora 1.12.6 release followed on 17 August. Earlier releases are affected.

Why a file analyser is an attractive target

Pandora accepts a document or archive specifically to unpack it, identify its format and run workers. A security function intentionally touches the most dangerous part of its input. Files may come from email, user submissions, SOC workflows or integrations, so a trusted sender is often not required.

Operators may assume risk stays inside a task directory. That assumption holds only when every extractor normalises paths, rejects unsafe links and enforces limits. One format handled by a different code path can bypass the common policy. These CVEs expose exactly that inconsistency.

Impact also depends on worker privileges. If the process can see configuration, service keys, a container socket, application code or shared volumes, leaving the analysis directory can compromise the service. When many tasks share a process, a decompression bomb harms other users as well.

CVE-2026-74764: an archive name becomes a host path

A TAR member stores a path name. It can contain ../ sequences, an absolute path or a link resolving outside the destination. A safe extractor must verify the final normalised location of every object, not merely concatenate dest_dir and a supplied name.

Affected Pandora code called Python’s tarfile.TarFile.extract without an extraction filter. A malicious member could therefore leave the intended directory. Potential consequences include overwriting files accessible to the process, changing configuration, denial of service and, in a suitable layout, code execution after a modified file is loaded or a service restarts.

The patch is small but semantically important: extraction now uses filter=‘data’. Python’s tarfile data filter rejects or neutralises dangerous members, including paths escaping the destination and unsafe link targets. It is stronger than searching for the literal ../ string, which absolute paths, links and platform differences can bypass.

A 10.0 score does not prove that every instance immediately yields a shell. The advisory models maximum impact when anonymous remote submission meets a valuable write target. Real blast radius depends on upload exposure, process rights and surrounding files. Arbitrary write outside a sandbox remains a critical boundary failure.

CVE-2026-74767: bounded input, unbounded output

DAA, or Direct Access Archive, can store compressed chunks of a disk image. Pandora called zlib.decompress without an output limit and accumulated decompressed chunks to construct an internal ISO. A small file with a high compression ratio could therefore force huge memory allocations and CPU cost.

An upload-size limit cannot solve this. The gateway sees a few megabytes while the worker may generate gigabytes. Security needs to track post-decompression size, the cumulative total and execution time. The same principle applies to ZIP, 7z, images, PDFs with embedded objects and recursive archives.

The fix moves to decompressobj().decompress with max_extracted_filesize, checks cumulative size and raises a dedicated ZipBomb exception once the boundary is crossed. The task ends as too large instead of continuing until memory is exhausted.

The 8.7 score reflects high availability impact without direct confidentiality or integrity loss. In a multi-tenant service, worker capacity is shared. Repeated submissions can exhaust a process pool, queue, host RAM and autoscaling budget.

What Pandora operators should do

Upgrade to Pandora 1.12.6 or later. Confirm the application and container-image version rather than only an IaC tag. If an image is cached in a private registry, verify its digest. After rollout, test that ordinary TAR and DAA files still analyse correctly while oversized files fail in a controlled state.

Until upgrading, restrict uploads to trusted sources, disable unnecessary formats or move extraction to disposable workers. Extension filtering is insufficient because content detection may select the parser and both names and MIME types can lie. If project fixes can be safely backported, apply both: the TAR filter and bounded DAA decompression.

Run workers as an unprivileged user with a read-only filesystem outside task directories. Provide secrets at the smallest scope and never mount the Docker socket or writable application code. Set limits for memory, CPU, execution time, process count and ephemeral storage.

Separate analysis workers from the API and queue. One task failure should not take down authentication, the interface or unrelated analyses. A disposable container or microVM with a discarded volume creates a stronger boundary than a shared directory and long-lived Python process.

Reviewing previous exploitation

For TAR, inspect submitted-file logs, archive member names and filesystem changes around analysis time. Look for absolute paths, traversal sequences, unusual symbolic links and changes outside task directories. Compare application and configuration files against a trusted image or manifest.

For DAA, correlate jobs with abrupt RSS growth, CPU time, OOMKilled, worker restarts and queue expansion. A small upload followed by large memory consumption is suggestive but not unique. Preserve a sample hash and metadata without reopening the file outside isolation.

If a worker could overwrite executable or configuration content, an upgrade is insufficient. Rebuild the container from a trusted image, discard the working volume, verify persistent data and rotate secrets available to the process. On bare metal, compare packages, systemd units, cron and keys with a reference state.

Architecture for a safer file pipeline

The first rule is to distrust the parser. A file format is not a passive blob; it is a program for an extractor. Names, sizes, member count, nesting depth and link relationships are control input.

The second rule is to apply a limit after every transformation. Check upload size, declared size, actual expanded bytes, cumulative output, recursive depth and time. Enforce limits while streaming, before all content enters memory or disk.

The third rule is destination verification. A resolved path must remain beneath the allowed root. Reject links, devices and unusual member types unless required. A library-provided safe filter is usually stronger than a home-grown character denylist.

The fourth rule is to assume worker compromise. No egress, minimal privileges, a read-only root filesystem and a disposable environment contain the next parser defect. Monitoring should measure cost per job so one file cannot hide inside host-wide averages.

Facts and Breachroad conclusions

CVE-2026-74764 enables a TAR write outside the destination and carries a 10.0 score. CVE-2026-74767 enables unbounded DAA expansion and scores 8.7. Fixes reached code on 15 August and release 1.12.6. The advisories do not confirm widespread exploitation.

Breachroad’s conclusion is that a service analysing hostile files must itself be treated as a highest-risk zone. A safe extraction library is necessary; durable protection comes from isolation, per-job budgets and keeping valuable secrets away from workers.

If you need to assess container isolation, upload pipelines and resource limits, see our cloud security assessment. SOC, DevSecOps and platform teams can also use cybersecurity training for organisations focused on safe handling of untrusted data.