CVE-2026-63134 in Malcolm's safe-extract.py is a path traversal in directory creation that the CVSS 5.4 rating undersells. The vulnerability lives in os.makedirs called on raw entry.pathname from the archive — the same script that correctly uses CARCHIVE_EXTRACT_SECURE flags for file extraction, creating a classic split: security controls applied to files, housekeeping treatment for directories. That's the failure mode.
The real issue isn't the directory creation in isolation. Malcolm is a network traffic analysis tool ingesting untrusted archives in a pipeline that feeds into filebeat for log indexing. The traversal doesn't just create directories outside the extraction target — it places directories where filebeat's watch scope can pick them up. An attacker who controls archive content controls what gets labeled as Malcolm-verified data forwarded to downstream SIEMs. That's the cascade CVSS doesn't model.
Check your deployment: Is Malcolm's container running with privileges that let directory creation outside the extraction path reach meaningful locations? Does filebeat have broad watch permissions that extend beyond the intended ingestion directory? Those are the exposure questions, and they're not answered by the CVE alone — they're documented debt in Malcolm's deployment model.
The fix in 26.07.0 normalizes paths before os.makedirs, which addresses the immediate bug. But the deeper question is whether there's defense in depth between extraction and forwarding, or just a single barrier that future patches will also apply unevenly. Given Malcolm's growing deployment footprint and the public changelog making the fix visible, the EPSS trajectory matters more than the static CVSS. Monitor for rule coverage and check whether your filebeat configuration's watch scope matches your security boundaries.