Pandora-analysis vulnerabilities
We track 4 vulnerabilities in Pandora-analysis products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 9, 2026.
Latest Pandora-analysis vulnerabilities
- 9.3 Critical severity
pandora: Improper Limitation of a Pathname to a Restricted Directory
Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intend
- 7.0 High severity
pandora: Improper Neutralization of Input During Web Page Generation
Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo act
- 8.7 High severity
pandora: Unrestricted Upload of File with Dangerous Type
Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the res
- 10.0 Critical severity
pandora: Improper Limitation of a Pathname to a Restricted Directory
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter