Applications treat names, paths, and extensions carried inside archive manifests and download metadata as if the application had chosen them. It did not. A tar entry pathname, an HLS subtitle URI, a shortcut extension, each is attacker-controlled, and each is later used verbatim as a filesystem decision. We study three 2026 CVEs that share this structure. CVE-2026-63134 (CISA Malcolm, CVSS 5.4) is a directory traversal in which directory entries skip the path guard that file entries pass, and os.path.join(dest, "/tmp/x") evaluates to /tmp/x because Python discards every argument before an absolute component, so the destination silently vanishes. CVE-2026-63133 (CVSS 6.5) is an inode-exhaustion denial of service in the same extractor: a ~50 KB archive of 50,000 empty directory entries creates 50,000 inodes in 2.2 s at an amplification of 1.0 inode per compressed byte, and a depth-axis variant produces many inodes from one entry. CVE-2026-50023 (yt-dlp, CVSS 8.3) is executable-shortcut injection: a permission scoped to the --write-link feature was hoisted to a global extension allowlist, so a subtitle track whose URI ends in .desktop writes an executable shortcut under --write-subs. The unifying class is trusting attacker-controlled filesystem metadata, and the cross-cutting root cause is a guard/sink mismatch: the security predicate is applied to one representation or context and omitted at a semantically equivalent sink. We give the exact code, payloads, and measured numbers, and ship three static audit rules.
Index terms: path traversal, zip slip, decompression bomb, inode exhaustion, allowlist, confused deputy, yt-dlp.