CISA Malcolm Multiple Vulnerabilities (Arbitrary Code Execution, Path Traversal, Auth Bypass, DoS)

Technical Analysis

The most severe issue, CVE-2026-55676 (CVSS 8.8), stems from an empty file-type allow-list in Malcolm's FilePond PHP upload backend, permitting upload and execution of arbitrary .php files as www-data, reachable even by users holding the low-privileged ROLE_UPLOAD role. Two authorization bypasses (CVE-2026-63177 and CVE-2026-19670) arise from mismatches between how nginx normalizes/decodes request URIs and how the OpenResty Lua RBAC layer evaluates raw or percent-encoded paths, allowing authenticated low-privilege users to reach admin-only endpoints (e.g., /htadmin, /auth, upload routes) via path traversal or percent-encoding tricks. Additional flaws include a path traversal in safe-extract.py's directory creation logic (CVE-2026-63134, CWE-22) and two denial-of-service issues (CVE-2026-63133, CVE-2026-19671) where malicious archives or single-stream compressed files (gzip/bzip2/xz bombs) can exhaust inodes or shared Docker volume storage used by OpenSearch, Logstash, Arkime, and Zeek, disrupting the entire processing pipeline. Organizations that deploy Malcolm to analyze network traffic feeding into SIEM/SOC pipelines that inform or gate AI-driven security agents, or that run Malcolm on shared infrastructure hosting agent frameworks, could see agent decision-making disrupted by DoS conditions or face lateral compromise if the RCE vector (CVE-2026-55676) is used to pivot toward credentials or API keys used by co-located agent tooling.

Affected Systems

CISA Malcolm versions <26.06.1 (CVE-2026-55676); <26.07.0 (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177); <=26.07.1 (CVE-2026-19670, CVE-2026-19671). Components affected include the FilePond PHP upload backend, nginx/OpenResty Lua RBAC layer, and safe-extract.py archive extraction module, along with shared Docker volumes used by OpenSearch, Logstash, Arkime, Zeek, and filebeat.

Indicators of Compromise

• No specific IOCs published; no known public exploitation reported by CISA at this time.
• Affected file paths: file-upload/php/config.php, scripts/safe-extract.py, nginx/lua/nginx_auth_helpers.lua
• Example exploitation endpoints: POST /server/php/submit.php, GET /server/php/files/*.php, /%68tadmin.php, /x/../upload/...

Remediation Steps

1. 1

   Upgrade Malcolm to patched versions

   Update to Malcolm 26.06.1 or later to fix CVE-2026-55676, 26.07.0 or later for CVE-2026-63133/63134/63177, and 26.08.0 or later for CVE-2026-19670/19671.

2. 2

   Restrict upload endpoint permissions

   Review RBAC role assignments, especially ROLE_UPLOAD, and ensure upload-only roles cannot reach the FilePond PHP backend or other sensitive endpoints until patched.

3. 3

   Isolate network exposure

   Ensure Malcolm instances are not directly internet-accessible; place behind firewalls/VPNs and restrict access to trusted management networks per CISA ICS guidance.

4. 4

   Monitor and limit resource consumption

   Implement filesystem quotas, inode limits, and upload size/entry-count restrictions on shared Docker volumes to mitigate DoS from decompression bombs or archive entry floods until patches are applied.

5. 5

   Audit access logs

   Review nginx and application logs for anomalous percent-encoded or traversal-style requests (e.g., containing '../' or encoded characters) targeting admin or upload endpoints.