CVE-2026-88069
Pandora contains a path traversal vulnerability in its archive extraction worker. An attacker who can submit a specially crafted archive could write files outside the intended extraction directory, potentially overwriting application or system files and leading to further compromise.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of Pandora (no specific versions or CPEs listed in the provided data).
Real-world impact
Successful exploitation could allow unauthorized modification of files accessible to the Pandora worker process, denial of service, and potentially further system compromise depending on process permissions.
Why this severity
CVSS 4.0 base score 9.3 (Critical). The vector indicates a network‑accessible attack with low complexity, no privileges or user interaction required, and high impact on integrity and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources; NVD description mentions a code‑level fix (resolving and verifying extraction paths) but no version, patch, or vendor advisory reference is provided.