Skip to content
OpenAdvisories
High ICSA-26-230-01 6 CVEs

CISA Malcolm

Published Aug 18, 2026 · Updated Aug 18, 2026

Vendor: CISA Product: Malcolm

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code.

Vulnerabilities 6

  • High 8.8
    CVE-2026-55676

    Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

    Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restri…

    CISAgov Malcolm
  • High 7.1
    CVE-2026-63177

    Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

    Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path…

    CISAgov Malcolm
  • Medium 6.5
    CVE-2026-19671

    Improper handling of highly compressed data (data amplification) in CISA Malcolm

    Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file …

    CISAgov Malcolm
  • Medium 6.5
    CVE-2026-63133

    Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)

    Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of direc…

    CISAgov Malcolm
  • Medium 5.4
    CVE-2026-19670

    Incorrect Authorization in CISA Malcolm

    Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded …

    CISAgov Malcolm
  • Medium 5.4
    CVE-2026-63134

    Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation

    Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no trave…

    CISAgov Malcolm

Revision history

  1. #1

    Initial Publication

References