Trusting the Filename: File-Write Attacks from Untrusted Archive and Download Metadata

Applications routinely treat the names, paths, and extensions carried inside archive manifests and download metadata as though they had chosen those values themselves, when in fact an attacker did. A tar entry pathname, an HLS subtitle URI, and a shortcut extension are all attacker-controlled strings, yet each is later consumed verbatim as a filesystem decision. We study three 2026 CVEs that share this structure. CVE-2026-63134 (CISA Malcolm, CVSS 5.4) is a directory traversal in which directory entries skip the path guard that file entries pass, so os.path.join(dest, "/tmp/x") evaluates to /tmp/x (Python discards every argument before an absolute component) and the destination silently vanishes. CVE-2026-63133 (CVSS 6.5) is an inode-exhaustion denial of service in the same extractor, where an archive of 50,000 empty directory entries, about 235 KB compressed, creates 50,000 filesystem objects at an amplification we reproduce near 0.21 objects per compressed byte, with a depth-axis variant that yields many objects from a single entry. CVE-2026-50023 (yt-dlp, CVSS 8.3) is executable-shortcut injection, in which a permission scoped to the -write-link feature was hoisted into a global extension allowlist, so a subtitle track whose URI ends in .desktop writes an executable shortcut under -write-subs. The unifying class is the trust an application places in attacker-controlled filesystem metadata, and within it we identify two failure modes: an inconsistently applied guard, where a security predicate runs on one representation or context but is omitted at a semantically equivalent sink, which accounts for the traversal and the shortcut cases, and a missing invariant, where no resource budget is enforced anywhere, which accounts for the inode case. For each we give the exact code, working payloads, and amplification figures reproduced on a documented environment, together with three static audit rules evaluated on the real vulnerable and patched source, one precise and two heuristic.