CVE-2026-32771 is a critical path traversal in the archive extractor of CTFer.io Monitoring, scored CVSS 9.8. A flawed prefix check lets a crafted archive write files outside the target directory. Upgrade to version 0.2.2 and limit which pods can write to the shared volume.
What's affected
The GitHub advisory lists the Go module github.com/ctfer-io/monitoring, versions before v0.2.2, with v0.2.2 as the patched version. The flawed function is sanitizeArchivePath in pkg/extract/extract.go.
It affects the extractor command line tool and the extract.DumpOTelCollector library function, which are used in a cold extract workflow that copies telemetry from a pod's volume. The NVD record adds that the default ReadWriteMany volume access mode lets any pod in the cluster place a malicious archive.
How to check if you're exposed
Check which module version you build or deploy:
go list -m github.com/ctfer-io/monitoring
For cluster deployments, check the image tag of the monitoring components against v0.2.2.
Then check the volume access mode, and which pods can write to the volume used for collector data:
kubectl get pvc -A
A ReadWriteMany claim shared by several workloads widens the exposure.
What to do now
- Upgrade CTFer.io Monitoring to v0.2.2 or later.
- Limit which pods can write to the shared volume, and avoid ReadWriteMany where you do not need it.
- Run the extractor as a non root user with a narrow file system scope.
- Review the output directory and its parent for unexpected files.
- Rebuild tools that vendor the extract package.
If you maintain code that unpacks archives, use this bug as a checklist item. A safe check joins the destination and the entry name, resolves the result, and then confirms the result sits inside the destination directory including a trailing separator, or uses a path function that reports containment directly.
Also test with entries that contain dot dot segments, absolute paths and names that share a prefix with the target folder. Those three cases catch most mistakes of this kind.
On the cluster side, shared ReadWriteMany volumes are convenient but blur trust boundaries. Ask whether every pod that can mount the claim truly needs to write to it.
Why it matters
The class is CWE-22, path traversal, and the specific bug is a classic one. The check compared a joined path to the destination directory using a string prefix test without a trailing separator. A sibling folder whose name starts with the destination name passes the test even though it is outside it.
The fix is to compare against the directory plus a separator, or to use a path function that checks containment. Archive extraction code is a repeat offender, known as zip slip, so any code that unpacks untrusted archives deserves this review. The record's KEV flag is false.
Quick check
Why does a missing slash matter?
Because the string extract-outputevil starts with extract-output. Without the separator, the prefix test treats a sibling directory as inside the target.
Sources
Last reviewed: 19 October 2026.
