# Archive extraction path escape

An archive member is extracted outside its designated output directory.

**Candidate CWE:** [CWE-22](https://cwe.mitre.org/data/definitions/22.html)

## Test hypothesis

In a disposable local directory, build a tiny archive with one ordinary file and one ../canary member. Run the actual product extraction route and compare resolved output paths with a normal archive. Where the format supports links, inspect one separate link-to-canary case and any pre-existing extraction-directory link, using the real product route and a disposable destination.

## Evidence required

The product creates a harmless marker outside the authorized extraction root. Preserve archive metadata, destination configuration, extraction API, and resulting filesystem paths. Record runtime, extraction filter, final resolved link targets, and any partial output left after rejection.

## Rule out false positives

A malicious member name being listed or rejected, or a testing script deliberately extracting outside the root instead of the product, is not a product vulnerability.

## Playbook and command references

- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Uploads%2C%20downloads%2C%20paths%2C%20archives%2C%20and%20XML)

## Referenced by these target playbooks

[OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html) · [Desktop & extensions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html) · [Web & API](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web-api.html) · [AI, agents & MCP](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/ai.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the [mapping guide](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html).

## Primary references

- [OWASP file upload security](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html)
- [Python tarfile extraction filters and limitations](https://docs.python.org/3/library/tarfile.html#extraction-filters)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)