Description
The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery (SSRF) to read HTTP, HTTPS, or FTP resources reachable from the upload container. In the default basic authentication mode this affects any authenticated user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CISA | Malcolm | ≤ 26.07.1 | 26.08.0 |
Advisories 1
- ICSA-26-280-01 CISA Malcolm CISA ICS & IT advisories · Oct 15, 2026