Detections
Analytics

SCA: security update for github.com/ctfer-io/monitoring (GHSA-f7cq-gvh6-qr25)

high Tenable Cloud Security Plugin ID 438866

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals
 (i.e. logs, metrics and distributed traces). In versions prior to 0.2.2, the sanitizeArchivePath function
 in pkg/extract/extract.go (lines 248–254) is vulnerable to Path Traversal due to a missing trailing path
 separator in the strings.HasPrefix check. The extractor allows arbitrary file writes (e.g., overwriting
 shell configs, SSH keys, kubeconfig, or crontabs), enabling RCE and persistent backdoors. The attack
 surface is further amplified by the default ReadWriteMany PVC access mode, which lets any pod in the
 cluster inject a malicious payload. This issue has been fixed in version 0.2.2. (CVE-2026-32771)

Solution

Update the github.com/ctfer-io/monitoring library and its related packages to version 0.2.2 or later.

See Also

https://github.com/advisories/GHSA-f7cq-gvh6-qr25

Plugin Details

Severity: High

ID: 438866

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 3/17/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.95

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-32771

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.8

Threat Score: 7.8

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/16/2026

Vulnerability Publication Date: 3/16/2026

Reference Information

CVE: CVE-2026-32771

cwe: CWE-22