Vulnerabilidade de Path Traversal no GuardDog Leva à Sobrescrita Arbitrária de Arquivos e RCE

The path traversal vulnerability in GuardDog allows attackers to bypass intended file system restrictions. By crafting malicious PyPI packages, an attacker can manipulate the safe_extract() function to write files outside the designated extraction directory. This file overwrite capability can be leveraged to inject malicious code, modify system configurations, or compromise sensitive data. Successful exploitation could grant an attacker complete control over the affected system, enabling them to execute arbitrary commands, steal credentials, or establish a persistent foothold. The potential blast radius extends to any system utilizing vulnerable versions of GuardDog, particularly those involved in automated software deployment or dependency management.

Organizations utilizing GuardDog for automated software deployment, dependency management, or package extraction are at significant risk. This includes DevOps teams, CI/CD pipelines, and any environment where third-party Python packages are automatically installed. Shared hosting environments where multiple users may have access to the system are particularly vulnerable.

• python / supply-chain:

import os
import zipfile

def safe_extract(archive_path, extract_to):
    with zipfile.ZipFile(archive_path, 'r') as zipf:
        for member in zipf.infolist():
            # Check if the extracted path is within the allowed directory
            if not extract_to in member.filename:
                print(f"Suspicious file: {member.filename}")

• generic web: Check for unusual file modifications in the GuardDog installation directory using file integrity monitoring tools.

1. 2026-01-13Disclosure

   disclosure

1. Reservado2026-01-12
2. Publicada2026-01-13
3. Modificada2026-02-03
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2026-22871 is to upgrade to GuardDog version 2.7.1 or later, which addresses the path traversal vulnerability. If immediate upgrading is not feasible, consider implementing temporary workarounds such as restricting the directories accessible to GuardDog or implementing stricter file system permissions. Monitor PyPI for suspicious packages and review dependencies regularly. Consider using a software composition analysis (SCA) tool to identify vulnerable dependencies in your projects. After upgrading, confirm the fix by attempting to extract a test archive and verifying that files are written only to the intended directory.