Trusting the Filename: File-Write Attacks from Untrusted Archive and Download Metadata

Source abstract

Applications treat names, paths, and extensions carried inside archive manifests and download metadata as if the application had chosen them. It did not. A tar entry pathname, an HLS subtitle URI, a shortcut extension. Each is attacker-controlled. Each is later used verbatim as a filesystem decision. We study three 2026 CVEs that share this structure. CVE-2026-63134 (CISA Malcolm, CVSS 5.4) is a directory traversal in which directory entries skip the path guard that file entries pass. os.path.join(dest, "/tmp/x") evaluates to /tmp/x because Python discards every argument before an absolute component. The destination silently vanishes. CVE-2026-63133 (CVSS 6.5) is an inode-exhaustion denial of service in the same extractor. A ∼50 KB archive of 50,000 empty directory entries creates 50,000 inodes in 2.2 s at an amplification of 1.0 inode per compressed byte. A depth-axis variant produces many inodes from one entry. CVE-2026-50023 (yt-dlp, CVSS 8.3) is executable-shortcut injection. A permission scoped to the -write-link feature was hoisted to a global extension allowlist. A subtitle track whose URI ends in .desktop writes an executable shortcut under -write-subs. The unifying class is trusting attacker-controlled filesystem metadata. The cross-cutting root cause is a guard/sink mismatch. The security predicate is applied to one representation or context and omitted at a semantically equivalent sink. We give the exact code, payloads, and measured numbers, and ship three static audit rules.