8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22871

CVE-2026-22871: GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22871

CVE-2026-22871:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
guarddog	pip	< 2.7.1	2.7.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue within the safe_extract function in guarddog/utils/archives.py. The core of the problem lies in the misuse of Python's zipfile.ZipFile.extract() method. The path parameter for this method is designed to receive the destination directory, and the method itself handles appending the member's filename. The vulnerable code, however, constructs a full path using os.path.join(target_directory, file) and passes it as the path. This causes the filename to be appended twice, which negates the library's built-in protection against path traversal attacks (e.g., filenames like ../../etc/passwd). The commit 9aa6a725b2c71d537d3c18d1c15621395ebb879c rectifies this by correctly passing only the target_directory to the path parameter. An attacker could exploit this by creating a malicious package that, when scanned by GuardDog, would write files to arbitrary locations on the system, leading to potential remote code execution.

Vulnerable functions

safe_extract

guarddog/utils/archives.py

The `safe_extract` function incorrectly uses `zip.extract` by passing a full file path to the `path` parameter instead of just the target directory. By using `os.path.join(target_directory, file)`, the filename from the archive is appended twice to the extraction path. This double-append bypasses the built-in path traversal sanitization of the `zipfile` library, allowing a maliciously crafted zip file to write files outside of the intended extraction directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.