6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28407

CVE-2026-28407: malcontent's nested archive extraction failure can drop content from scan inputs

malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28407

CVE-2026-28407:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/chainguard-dev/malcontent	go	< 1.21.0	1.21.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-28407, exists in the malcontent library's handling of nested archives. The core issue was that if a nested archive failed to extract, the library would delete the archive file, preventing any further analysis of its contents. This could allow an attacker to bypass scanning by creating a specially crafted archive that triggers an extraction failure.

The analysis of the patch commit 356c56659ccfcad0b249a97de8cf71f151ed3ee9 pinpoints the vulnerable logic within the extractNestedArchive function in pkg/archive/archive.go. The diff clearly shows that the unconditional call to os.Remove(fullPath) was the source of the vulnerability. The fix wraps this call in a conditional block (if err == nil), ensuring that the archive is only deleted if it was successfully extracted. If extraction fails, the file is now preserved, allowing the scanner to process it as a regular file, thus mitigating the vulnerability. Therefore, archive.extractNestedArchive is the specific function that would be active during the exploitation of this vulnerability.

Vulnerable functions

archive.extractNestedArchive

pkg/archive/archive.go

The vulnerability lies in this function's handling of nested archive extraction errors. Prior to the patch, if an error occurred during the extraction of a nested archive (and the `ExitExtraction` config was false), the function would log the error but then unconditionally attempt to remove the original archive file with `os.Remove(fullPath)`. This behavior could be exploited by crafting a nested archive that intentionally fails extraction, causing it to be deleted and its contents to be excluded from the security scan, potentially hiding malicious content. The fix ensures that the archive file is only removed if the extraction is successful (`err == nil`), otherwise, it is preserved to allow for a best-effort scan of its raw bytes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.