Malcolm
Monthly
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary directories outside the intended extraction root on the filebeat processing container. All Malcolm releases prior to 26.07.0 are affected via the `safe-extract.py` component, which inconsistently applies traversal protections - libarchive secure flags guard file entries, but directory entries are passed directly to an unguarded `os.makedirs()` call. No confirmed active exploitation or public proof-of-concept has been identified; the vendor released a complete fix in version 26.07.0.
Resource exhaustion in Malcolm's archive extraction component allows authenticated network users to deny service to the entire processing pipeline. Prior to version 26.07.0, the `safe-extract.py` script imposes no limits on the count, depth, or output size of entries extracted from uploaded archives, enabling a low-privilege attacker to craft a small archive that expands into an unbounded number of filesystem objects. The resulting inode exhaustion affects the filebeat container and any co-mounted service, effectively halting network traffic analysis. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Malcolm (cisagov) prior to version 26.06.1 allows an authenticated user holding the ROLE_UPLOAD role to upload arbitrary PHP files through the FilePond file-upload component and trigger their server-side execution. The file-type allowlist in `file-upload/php/config.php` is an empty array by default, making the type check a no-op; the filename sanitizer further preserves the `.php` extension intact, and nginx routes any URL terminating in `.php` to php-fpm. No public exploit code has been confirmed and Malcolm is not listed in the CISA KEV catalog at time of analysis, but the CVSS 8.8 rating (CWE-434) and straightforward exploitation path make this a genuine priority for any deployment running a pre-26.06.1 release with RBAC enabled.
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary directories outside the intended extraction root on the filebeat processing container. All Malcolm releases prior to 26.07.0 are affected via the `safe-extract.py` component, which inconsistently applies traversal protections - libarchive secure flags guard file entries, but directory entries are passed directly to an unguarded `os.makedirs()` call. No confirmed active exploitation or public proof-of-concept has been identified; the vendor released a complete fix in version 26.07.0.
Resource exhaustion in Malcolm's archive extraction component allows authenticated network users to deny service to the entire processing pipeline. Prior to version 26.07.0, the `safe-extract.py` script imposes no limits on the count, depth, or output size of entries extracted from uploaded archives, enabling a low-privilege attacker to craft a small archive that expands into an unbounded number of filesystem objects. The resulting inode exhaustion affects the filebeat container and any co-mounted service, effectively halting network traffic analysis. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Malcolm (cisagov) prior to version 26.06.1 allows an authenticated user holding the ROLE_UPLOAD role to upload arbitrary PHP files through the FilePond file-upload component and trigger their server-side execution. The file-type allowlist in `file-upload/php/config.php` is an empty array by default, making the type check a no-op; the filename sanitizer further preserves the `.php` extension intact, and nginx routes any URL terminating in `.php` to php-fpm. No public exploit code has been confirmed and Malcolm is not listed in the CISA KEV catalog at time of analysis, but the CVSS 8.8 rating (CWE-434) and straightforward exploitation path make this a genuine priority for any deployment running a pre-26.06.1 release with RBAC enabled.