The vulnerability CVE-2026-90453 in CISA Malcolm involves an open redirect (CWE-601) where the file-upload handler uses the Referer header from the request to redirect the authenticated client's browser without validating the destination URL. This lack of validation enables an attacker with authentication to create a request that, upon upload completion, redirects another user's browser to an arbitrary external URL. The CVSS 4.0 base score is 5.1, indicating medium severity. The affected versions are all versions from 0 up to but excluding 26.06.0.

An attacker with authentication privileges can exploit this vulnerability to redirect users to arbitrary external websites after a file upload completes. This could potentially be used for phishing or redirecting users to malicious sites, but the vulnerability requires user interaction and authentication. There is no indication of direct code execution or data compromise from this vulnerability alone.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about the URLs used in the Referer header and avoid clicking suspicious links that trigger file uploads. Implementing input validation on redirect URLs or restricting redirects to trusted origins is recommended once a fix is available.