CVE-2026-32771

CriticalPublic PoC

Published: 20 March 2026

Published

20 March 2026

Modified

16 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0004 12.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32771 is a critical-severity Path Traversal (CWE-22) vulnerability in Ctfer Monitoring. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 4 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mandates input validation and sanitization of archive paths to block path traversal exploits in the sanitizeArchivePath function.

AC-3 Access Enforcement good match

prevent

Enforces strict access controls on files and directories, preventing arbitrary writes to critical host resources like shell configs, SSH keys, or kubeconfig even if path traversal occurs.

AC-6 Least Privilege good match

prevent

Implements least privilege for the monitoring component's processes and pods, restricting write access to shared PVCs and host files to mitigate RCE and persistence from malicious payloads.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

T1053.003 Cron Execution

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.

attack.mitre.org →

T1098.004 SSH Authorized Keys Persistence

Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host.

attack.mitre.org →

T1546.004 Unix Shell Configuration Modification Privilege Escalation

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing archive extraction (T1190) directly enables arbitrary file writes to overwrite crontabs (T1053.003), shell rc files (T1546.004), SSH keys (T1098.004), and scripts, facilitating Unix shell command execution (T1059.004) and RCE/persistence.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). In versions prior to 0.2.2, the sanitizeArchivePath function in pkg/extract/extract.go (lines 248–254) is vulnerable to Path Traversal due…

to a missing trailing path separator in the strings.HasPrefix check. The extractor allows arbitrary file writes (e.g., overwriting shell configs, SSH keys, kubeconfig, or crontabs), enabling RCE and persistent backdoors. The attack surface is further amplified by the default ReadWriteMany PVC access mode, which lets any pod in the cluster inject a malicious payload. This issue has been fixed in version 0.2.2.

Deeper analysisAI

CVE-2026-32771 is a path traversal vulnerability in the CTFer.io Monitoring component, which handles the collection, processing, and storage of signals such as logs, metrics, and distributed traces. The issue resides in the sanitizeArchivePath function within pkg/extract/extract.go (lines 248–254) of versions prior to 0.2.2, stemming from a missing trailing path separator in the strings.HasPrefix check. This flaw enables arbitrary file writes on the host system. It has been assigned CWE-22 and a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, and no privileges required.

Attackers can exploit this vulnerability remotely without authentication by crafting malicious archives that traverse directories during extraction, allowing them to overwrite critical files such as shell configurations, SSH keys, kubeconfig, or crontabs. This leads to remote code execution (RCE) and the establishment of persistent backdoors. The attack surface is expanded by the default ReadWriteMany persistent volume claim (PVC) access mode in Kubernetes environments, permitting any pod in the cluster to inject a malicious payload and trigger the extraction process.

The vulnerability has been addressed in CTFer.io Monitoring version 0.2.2. Official advisories, including the GitHub security advisory (GHSA-f7cq-gvh6-qr25) and the fixing commit (269dba165aa42210352628c0db6756f3b8fd3c8a), detail the patch that corrects the path sanitization logic. Additional context is provided in Snyk's research on Zip Slip vulnerabilities, highlighting similar extraction-related path traversal risks.