CVE-2026-55676: CWE-434: Unrestricted Upload of File with Dangerous Type in cisagov Malcolm
Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the `.php` extension intact. Committed files land in `/var/www/upload/server/php/files` (`file-upload/php/config.php:7`), and the component's nginx routes any URL ending in `.php` to php-fpm. An authenticated `GET /server/php/files/<name>.php` then executes the uploaded code as `www-data`. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular `ROLE_UPLOAD` role (`nginx/lua/nginx_auth_helpers.lua:71`), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as `www-data` inside the file-upload container. Version 26.06.1 fixes the issue.
AI Analysis
Technical Summary
Malcolm's file upload component uses a PHP backend that accepts files at POST /server/php/submit.php. The allow-list for file types is empty by default, making the type check ineffective and allowing any file extension, including .php. Uploaded files are stored in /var/www/upload/server/php/files, which is served by nginx and php-fpm, routing requests ending in .php to the PHP interpreter. Authenticated users with the ROLE_UPLOAD role, intended only for submitting capture files, can upload and then execute arbitrary PHP code as the www-data user. This vulnerability is present prior to version 26.06.1, which includes the fix.
Potential Impact
An authenticated user with the upload-only role can execute arbitrary PHP code on the server with www-data privileges, leading to full compromise of the file-upload container. This can result in complete confidentiality, integrity, and availability loss of the affected system component.
Mitigation Recommendations
Version 26.06.1 of Malcolm fixes this vulnerability by restricting file uploads and execution. Users should upgrade to version 26.06.1 or later to remediate this issue. No official patch or workaround is documented beyond upgrading. Until upgrading, restrict the ROLE_UPLOAD permission carefully and avoid granting it to untrusted users.
CVE-2026-55676: CWE-434: Unrestricted Upload of File with Dangerous Type in cisagov Malcolm
Description
Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the `.php` extension intact. Committed files land in `/var/www/upload/server/php/files` (`file-upload/php/config.php:7`), and the component's nginx routes any URL ending in `.php` to php-fpm. An authenticated `GET /server/php/files/<name>.php` then executes the uploaded code as `www-data`. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular `ROLE_UPLOAD` role (`nginx/lua/nginx_auth_helpers.lua:71`), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as `www-data` inside the file-upload container. Version 26.06.1 fixes the issue.
CVSS v3.1
Score 8.8high
Affected software
cisagov
Malcolm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Malcolm's file upload component uses a PHP backend that accepts files at POST /server/php/submit.php. The allow-list for file types is empty by default, making the type check ineffective and allowing any file extension, including .php. Uploaded files are stored in /var/www/upload/server/php/files, which is served by nginx and php-fpm, routing requests ending in .php to the PHP interpreter. Authenticated users with the ROLE_UPLOAD role, intended only for submitting capture files, can upload and then execute arbitrary PHP code as the www-data user. This vulnerability is present prior to version 26.06.1, which includes the fix.
Potential Impact
An authenticated user with the upload-only role can execute arbitrary PHP code on the server with www-data privileges, leading to full compromise of the file-upload container. This can result in complete confidentiality, integrity, and availability loss of the affected system component.
Mitigation Recommendations
Version 26.06.1 of Malcolm fixes this vulnerability by restricting file uploads and execution. Users should upgrade to version 26.06.1 or later to remediate this issue. No official patch or workaround is documented beyond upgrading. Until upgrading, restrict the ROLE_UPLOAD permission carefully and avoid granting it to untrusted users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-17T00:05:03.778Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7b858ebf8831d5395e02ae
Added to database: 08/11/2026, 20:26:54 UTC
Last enriched: 08/11/2026, 20:41:07 UTC
Last updated: 09/26/2026, 00:14:42 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.