A critical path traversal vulnerability in the Pandora archive extraction functionality allows remote attackers to execute arbitrary code or compromise the system by overwriting critical files.

The application fails to sanitize TAR archive member paths before extraction, utilizing Python's tarfile.TarFile.extract() without an extraction filter. This allows an attacker to use absolute paths or directory traversal sequences to write files outside the intended destination directory.

Successful exploitation can lead to full system compromise, as an attacker can overwrite configuration files, system binaries, or application code. This poses a catastrophic risk to data integrity and system availability, warranting the maximum CVSS score of 10.0.

Immediate Action: Review the vendor repository for the latest release that implements the filter='data' extraction filter within the TAR processing logic.

Proactive Monitoring: Monitor filesystem integrity and watch for unexpected file creation or modification events within the directory structure of the Pandora worker process.

Compensating Controls: Run the Pandora worker process with the least privilege necessary, ideally within a containerized environment with a read-only filesystem to limit the impact of arbitrary file writes.

Public Exploit Available: No

Given the critical nature of this path traversal flaw, it is imperative to restrict the processing of untrusted archives immediately. Verify that the application is updated to the latest version as soon as the patch is confirmed by the vendor, and ensure that all file operations are performed within a restricted or sandboxed environment.