Threat Intelligence Database

CVE-2026-63177 is an authorization vulnerability in cisagov Malcolm, a network traffic analysis tool. Before version 26.07.0, the role-based access control in the Nginx OpenResty Lua layer evaluates the raw request URI without normalization, while Nginx routes requests using a normalized path. This discrepancy allows an authenticated low-privilege user to bypass access controls by using path traversal segments, gaining unauthorized access to restricted backend resources. The issue is fixed in version 26.07.0.

CVE-2026-63134 is a path traversal vulnerability in cisagov Malcolm, a network traffic analysis tool suite. Prior to version 26.07.0, the safe-extract.py script uses libarchive's secure flags but creates directories without proper traversal protection, allowing crafted archive entries with '../' sequences or absolute paths to create directories outside the intended extraction location. This issue is fixed in version 26.07.0.

CVE-2026-63133 is a resource exhaustion vulnerability in cisagov Malcolm prior to version 26.07.0. The safe-extract.py script extracts uploaded archives without limits on entry count, directory depth, total entries, or output size. A malicious archive with many entries can cause unbounded filesystem object creation, exhausting inodes or filesystem metadata and causing denial of service to the processing pipeline and any services sharing the same mount. Version 26.07.0 addresses this issue.

CVE-2026-55676 is a high-severity vulnerability in cisagov Malcolm, a network traffic analysis tool suite. The file upload component improperly allows uploading files with dangerous extensions, including .php, due to an empty allow-list for file types. Uploaded PHP files are stored in a web-accessible directory and can be executed by an authenticated user with the ROLE_UPLOAD permission. This leads to arbitrary code execution as the web server user. The issue is fixed in version 26.06.1.