CISA Malcolm up to 26.06.0 config.php unrestricted upload

Summaryinfo

A vulnerability was found in CISA Malcolm up to 26.06.0 and classified as critical. Impacted is an unknown function of the file file-upload/php/config.php. The manipulation results in unrestricted upload. This vulnerability is reported as CVE-2026-55676. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in CISA Malcolm up to 26.06.0. Affected is an unknown code of the file file-upload/php/config.php. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the `.php` extension intact. Committed files land in `/var/www/upload/server/php/files` (`file-upload/php/config.php:7`), and the component's nginx routes any URL ending in `.php` to php-fpm. An authenticated `GET /server/php/files/<name>.php` then executes the uploaded code as `www-data`. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular `ROLE_UPLOAD` role (`nginx/lua/nginx_auth_helpers.lua:71`), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as `www-data` inside the file-upload container. Version 26.06.1 fixes the issue.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-55676 since 06/17/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1608.002 by the MITRE ATT&CK project.

By approaching the search of inurl:file-upload/php/config.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 26.06.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• CISA

Name

• Malcolm

Version

• 26.06

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion