Cisagov
Monthly
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Unbounded archive extraction in Malcolm, CISA's network traffic analysis tool suite, allows a user who can reach the archive/PCAP upload path (authenticated, low-privilege per the CVSS PR:L vector) to exhaust filesystem inodes and metadata on the filebeat processing container by submitting a small malicious archive containing an enormous number of directory or file entries, denying service to the processing pipeline and to any service sharing the same mount. safe-extract.py in all versions before 26.07.0 places no limit on entry count, directory depth, total entries, or output size, so the failure is a pure availability impact with no confidentiality or integrity loss (VC:N/VI:N/VA:H). Version 26.07.0 fixes the issue, the EPSS score is a low 0.25% (16th percentile), the CISA SSVC assessment records proof-of-concept exploitation with Automatable set to no, and there is no CISA KEV listing, making this a genuine but moderate-priority availability defect rather than a critical emergency.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite can upload a .php file that the suite's own nginx routes to php-fpm and executes as www-data inside the file-upload container, yielding remote code execution in the file-upload component. The flaw (CWE-434, unrestricted file upload) affects Malcolm versions before 26.06.1 and is reachable only when Malcolm runs in RBAC mode, where the upload endpoint is exposed to the upload-only role; unauthenticated users cannot reach it (CVSS:3.1 PR:L, assessed high impact C:H/I:H/A:H). There is no public exploit code identified at time of analysis and EPSS is low (0.30%, 22nd percentile), while the vendor-released fix is Malcolm 26.06.1.
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary directories outside the intended extraction root on the filebeat processing container. All Malcolm releases prior to 26.07.0 are affected via the `safe-extract.py` component, which inconsistently applies traversal protections - libarchive secure flags guard file entries, but directory entries are passed directly to an unguarded `os.makedirs()` call. No confirmed active exploitation or public proof-of-concept has been identified; the vendor released a complete fix in version 26.07.0.
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Unbounded archive extraction in Malcolm, CISA's network traffic analysis tool suite, allows a user who can reach the archive/PCAP upload path (authenticated, low-privilege per the CVSS PR:L vector) to exhaust filesystem inodes and metadata on the filebeat processing container by submitting a small malicious archive containing an enormous number of directory or file entries, denying service to the processing pipeline and to any service sharing the same mount. safe-extract.py in all versions before 26.07.0 places no limit on entry count, directory depth, total entries, or output size, so the failure is a pure availability impact with no confidentiality or integrity loss (VC:N/VI:N/VA:H). Version 26.07.0 fixes the issue, the EPSS score is a low 0.25% (16th percentile), the CISA SSVC assessment records proof-of-concept exploitation with Automatable set to no, and there is no CISA KEV listing, making this a genuine but moderate-priority availability defect rather than a critical emergency.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite can upload a .php file that the suite's own nginx routes to php-fpm and executes as www-data inside the file-upload container, yielding remote code execution in the file-upload component. The flaw (CWE-434, unrestricted file upload) affects Malcolm versions before 26.06.1 and is reachable only when Malcolm runs in RBAC mode, where the upload endpoint is exposed to the upload-only role; unauthenticated users cannot reach it (CVSS:3.1 PR:L, assessed high impact C:H/I:H/A:H). There is no public exploit code identified at time of analysis and EPSS is low (0.30%, 22nd percentile), while the vendor-released fix is Malcolm 26.06.1.
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary directories outside the intended extraction root on the filebeat processing container. All Malcolm releases prior to 26.07.0 are affected via the `safe-extract.py` component, which inconsistently applies traversal protections - libarchive secure flags guard file entries, but directory entries are passed directly to an unguarded `os.makedirs()` call. No confirmed active exploitation or public proof-of-concept has been identified; the vendor released a complete fix in version 26.07.0.