Read the docs
TI-2026-69642 Aliases CVE-2026-107362GHSA-6x93-f29r-jwj6

Server-side request forgery in Malcolm file upload component

Priority MEDIUM 64CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Malcolm versions up to and including 26.07.1 are affected. The bundled FilePond PHP server in the file-upload component has a server-side request forgery flaw (CWE-918) because its fetch route retrieves arbitrary URLs and returns the responses to the caller. An authenticated user can read HTTP, HTTPS, or FTP resources reachable from the upload container, and in the default basic authentication mode any authenticated user can do this.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery (SSRF) to read HTTP, HTTPS, or FTP resources reachable from the upload container. In the default basic authentication mode this affects any authenticated user.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Fixed Malcolm (CISA): 26.08.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CISAMalcolmup to 26.07.126.08.0Patch availableCNA
  • Malcolm VendorCISA Affected up to 26.07.1 Fixed in 26.08.0 Patch available CNA

Remediation

Upgrade Malcolm to version 26.08.0, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Malcolm (CISA) Fixed in 26.08.0

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107362
  2. 2026-10-09 Alias added: GHSA-6x93-f29r-jwj6
  3. 2026-10-09 CISA SSVC decision points changed

References

Other 2

  • TI-2026-69640 Cross-Site Request Forgery in Malcolm CVSS 3.1HIGH 7.1
  • TI-2026-69638 Compressed file uploads in Malcolm can exhaust shared disk space CVSS 3.1MEDIUM 6.5
  • TI-2026-69637 Incorrect authorization in Malcolm exposes role-restricted paths CVSS 3.1MEDIUM 5.4
  • TI-2025-24590 CISA Thorium download stream divide by zero CVSS 4.0MEDIUM 5.3
  • TI-2025-24585 CISA Thorium insecure downloaded file path validation CVSS 4.0MEDIUM 5.3
  • TI-2025-41377 Software Acquisition Guide Supplier Response Web Tool XSS CVSS 4.0MEDIUM 4.6
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences