CVE-2026-22871: GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
Summary
CVE-2026-22871: GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE. Affects guarddog versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GuardDog is a Python package designed to scan and analyze packages from the Python Package Index (PyPI) for vulnerabilities. It helps developers ensure the security of their applications by identifying potentially harmful packages. However, a critical vulnerability has been discovered in its safe_extract() function, which can lead to severe security risks.
Vulnerability Detail
A path traversal vulnerability exists in GuardDog's safe_extract() function, allowing malicious PyPI packages to write arbitrary files outside the intended extraction directory. This can lead to Arbitrary File Overwrite and Remote Code Execution (RCE) on systems running GuardDog. The vulnerability arises from incorrect usage of Python's zipfile.ZipFile.extract() API, where the path parameter is improperly constructed, bypassing built-in path traversal sanitization. Attackers can exploit this by creating malicious packages with path traversal filenames, leading to potential immediate code execution or persistent backdoors.
How To Fix
Minimum fixed version
2.7.1
This is the first release that contains the fix.
pip install --upgrade "guarddog==2.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using GuardDog to scan untrusted or unknown PyPI packages until you can update to the patched version. Additionally, consider implementing file system permissions to limit the impact of any potential exploitation.
Conclusion
The path traversal vulnerability in GuardDog poses significant security risks, including arbitrary file overwrites and remote code execution. It is crucial for users to update to the patched version 2.7.1 or later to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for guarddog →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The impacts include arbitrary file overwrites, remote code execution, and the potential for persistent backdoors on affected systems.
As a temporary measure, refrain from scanning untrusted packages with GuardDog and implement file system permissions to mitigate risks.
The vulnerability was reported by Charbel (dwbruijn).
References
Related vulnerabilities
Recent vulnerabilities recorded for guarddog.
