Which versions of Malcolm are affected by EUVD-2026-56948?

Malcolm, CISA's network traffic analysis suite, contains a high-severity vulnerability (CVE-2026-55676) that allows an authenticated user with limited upload permissions to execute arbitrary code…. A patch is available.

How to fix or mitigate EUVD-2026-56948?

Within 24 hours, identify all Malcolm instances and determine which are running versions prior to 26.06.1 in RBAC mode, then immediately restrict access to the upload endpoint to only fully trusted administrators; within 7 days, apply the vendor-released patch by upgrading to Malcolm 26.06.1 or later, and verify that the ROLE_UPLOAD permission is not assigned to unnecessary accounts; within 30 days, conduct a review of user roles and permissions to enforce least privilege, monitor for suspicious file uploads, and ensure all Malcolm deployments are updated to the latest supported version.

Malcolm EUVD-2026-56948

Q: What is the CVSS score of EUVD-2026-56948?

EUVD-2026-56948 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-55676 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-11 GitHub_M

PHP Nginx File Upload Malcolm Cisagov

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable upload endpoint (AV:N), trivial allow-list bypass (AC:L), requires an authenticated ROLE_UPLOAD account (PR:L), no user interaction; RCE in-container yields full C/I/A with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Oct 02, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Oct 02, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Oct 02, 2026 - 21:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Source Code Evidence Fetched

Aug 11, 2026 - 21:36 vuln.today

Analysis Generated

Aug 11, 2026 - 21:36 vuln.today

Patch available

Aug 11, 2026 - 21:18 EUVD

CVE Published

Aug 11, 2026 - 20:24 cve.org

HIGH 8.8

DescriptionCVE.org

Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (file-upload/php/config.php:16), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the .php extension intact. Committed files land in /var/www/upload/server/php/files (file-upload/php/config.php:7), and the component's nginx routes any URL ending in .php to php-fpm. An authenticated GET /server/php/files/<name>.php then executes the uploaded code as www-data. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular ROLE_UPLOAD role (nginx/lua/nginx_auth_helpers.lua:71), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as www-data inside the file-upload container. Version 26.06.1 fixes the issue.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 6 High Severity, No Public POC Aug 12, 2026

AnalysisAI

Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite can upload a .php file that the suite's own nginx routes to php-fpm and executes as www-data inside the file-upload container, yielding remote code execution in the file-upload component. The flaw (CWE-434, unrestricted file upload) affects Malcolm versions before 26.06.1 and is reachable only when Malcolm runs in RBAC mode, where the upload endpoint is exposed to the upload-only role; unauthenticated users cannot reach it (CVSS:3.1 PR:L, assessed high impact C:H/I:H/A:H). There is no public exploit code identified at time of analysis and EPSS is low (0.30%, 22nd percentile), while the vendor-released fix is Malcolm 26.06.1.

Technical ContextAI

Malcolm's file-upload component bundles a FilePond PHP backend that accepts uploads at POST /server/php/submit.php and persists them under a directory served by the same nginx/php-fpm instance. The intended file-type allow-list in file-upload/php/config.php line 16 is an empty array by default, which makes the type check a no-op so every extension is accepted; the filename sanitizer additionally preserves a trailing .php extension. Uploaded artifacts land in /var/www/upload/server/php/files (config.php line 7), and the component's nginx configuration forwards any URL ending in .php to php-fpm rather than serving it as a static file, so a subsequent authenticated GET /server/php/files/<name>.php executes the attacker's code as the unprivileged www-data account. Reachability is governed by Malcolm's RBAC layer: in RBAC mode, nginx/lua/nginx_auth_helpers.lua line 71 permits the granular ROLE_UPLOAD role (meant only for submitting capture files) to hit the upload endpoint. This is a classic CWE-434 unrestricted upload enabled by two compounding misconfigurations - a disabled extension allow-list and a web-server rule that executes content from the upload directory - with no confirmed cross-container scope change (SC:N/SI:N/SA:N).

RemediationAI

Upgrade Malcolm to version 26.06.1, the vendor-released fix for GHSA-8cvp-m7pg-qrp7 (details in CISA ICSA-26-230-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01). Before upgrading, note the vendor's own caveat: release 26.06.1 ships PostgreSQL changes that break compatibility with databases from prior releases (GitHub issue 1038), so the project recommends either backing up and restoring the NetBox database per https://idaholab.github.io/Malcolm/docs/asset-interaction-analysis.html#NetBoxBackup or not using keycloak as the auth method; installations coming from an existing deployment should run ./scripts/status first so Malcolm migrates settings before ./scripts/configure or ./scripts/start. If the upgrade must be deferred, apply compensating controls in this order: revoke or tightly restrict the ROLE_UPLOAD role so that only fully trusted operators can reach POST /server/php/submit.php (this removes the delegated-uploader attack path but breaks legitimate capture-file submission by that role); block or 403 any request to /server/php/files/*.php at the nginx/reverse-proxy layer so nothing in the upload directory can be routed to php-fpm (trade-off: uploaded capture files with a .php extension become inaccessible, which should be rare); and set the allow-list array in file-upload/php/config.php to the specific capture-file extensions actually used instead of the vulnerable empty default (trade-off: mis-scoped allow-lists silently reject legitimate uploads, so validate against real capture workflows). Network-isolating the file-upload container and monitoring for unexpected .php files in /var/www/upload/server/php/files provide additional detection while remediation is pending.