EUVD-2026-56948Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L confirmed by ROLE_UPLOAD authentication requirement; S:U because execution is confined to www-data in the file-upload container with no cross-container scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (file-upload/php/config.php:16), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the .php extension intact. Committed files land in /var/www/upload/server/php/files (file-upload/php/config.php:7), and the component's nginx routes any URL ending in .php to php-fpm. An authenticated GET /server/php/files/<name>.php then executes the uploaded code as www-data. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular ROLE_UPLOAD role (nginx/lua/nginx_auth_helpers.lua:71), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as www-data inside the file-upload container. Version 26.06.1 fixes the issue.
Articles & Coverage 1
AnalysisAI
Remote code execution in Malcolm (cisagov) prior to version 26.06.1 allows an authenticated user holding the ROLE_UPLOAD role to upload arbitrary PHP files through the FilePond file-upload component and trigger their server-side execution. The file-type allowlist in file-upload/php/config.php is an empty array by default, making the type check a no-op; the filename sanitizer further preserves the .php extension intact, and nginx routes any URL terminating in .php to php-fpm. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Malcolm user account with the ROLE_UPLOAD RBAC role explicitly assigned - this role is intended for submitting network capture files and is meaningfully distinct from administrator roles, but may be granted broadly to analysts or automated ingest pipelines. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated and not inflated: the attack path is mechanical - upload a PHP file, GET it - and requires only low-privilege authentication rather than no authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a Malcolm account holding the ROLE_UPLOAD RBAC role submits a PHP webshell (e.g., a file named `shell.php` containing `<?php system($_GET['cmd']); ?>`) via an authenticated POST to `/server/php/submit.php`; the server stores the file at `/var/www/upload/server/php/files/shell.php` without stripping the extension. The attacker then issues an authenticated GET to `/server/php/files/shell.php?cmd=id`, nginx routes the request to php-fpm, and the webshell executes as `www-data` inside the file-upload container, granting interactive command execution. … |
| Remediation | Upgrade to Malcolm v26.06.1, which directly resolves the unrestricted PHP upload path per the vendor advisory at https://github.com/cisagov/Malcolm/security/advisories/GHSA-8cvp-m7pg-qrp7 and the release at https://github.com/cisagov/Malcolm/releases/tag/v26.06.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Malcolm deployments and determine which run versions prior to 26.06.1, then confirm role-based access control (RBAC) enablement on each instance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today