{"cve":"CVE-2026-32771","nvd":{"published":"2026-03-20T01:15:55.940","modified":"2026-06-17T10:36:21.433","status":"Analyzed","description":"The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). In versions prior to 0.2.2, the sanitizeArchivePath function in pkg/extract/extract.go (lines 248–254) is vulnerable to Path Traversal due to a missing trailing path separator in the strings.HasPrefix check. The extractor allows arbitrary file writes (e.g., overwriting shell configs, SSH keys, kubeconfig, or crontabs), enabling RCE and persistent backdoors. The attack surface is further amplified by the default ReadWriteMany PVC access mode, which lets any pod in the cluster inject a malicious payload. This issue has been fixed in version 0.2.2.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L","score":8.8},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-22"],"references":["https://github.com/ctfer-io/monitoring/commit/269dba165aa42210352628c0db6756f3b8fd3c8a","https://github.com/ctfer-io/monitoring/security/advisories/GHSA-f7cq-gvh6-qr25","https://security.snyk.io/research/zip-slip-vulnerability#expandable-socPI9fFAJ-title"],"products":["ctfer:monitoring"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2026-32771","score":0.00666,"percentile":0.51855,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-f7cq-gvh6-qr25","url":"https://osv.dev/vulnerability/GHSA-f7cq-gvh6-qr25","summary":"Monitoring is vulnerable to Archive Slip due to missing checks in sanitization","modified":"2026-05-05T15:55:50.022212Z","packages":[{"ecosystem":"Go","name":"github.com/ctfer-io/monitoring","purl":"pkg:golang/github.com/ctfer-io/monitoring","ranges":["<0.2.2"],"fixed":["0.2.2"]}]},{"id":"GO-2026-4712","url":"https://osv.dev/vulnerability/GO-2026-4712","summary":"Monitoring is vulnerable to Archive Slip due to missing checks in sanitization in github.com/ctfer-io/monitoring","modified":"2026-03-26T21:03:15.110237Z","packages":[{"ecosystem":"Go","name":"github.com/ctfer-io/monitoring","purl":"pkg:golang/github.com/ctfer-io/monitoring","ranges":["<0.2.2"],"fixed":["0.2.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}