CVE-2026-107335

Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.

• CWE-409

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json
• https://github.com/cisagov/Malcolm/security/advisories/GHSA-jr6p-63pg-hr6g
• https://github.com/cisagov/Malcolm/security/advisories/GHSA-jr6p-63pg-hr6g

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107324An integer overflow in BSON value-length handling in the Mon…5.9
• CVE-2026-107325Improper validation of a BSON array length in the MongoDB Go…5.9
• CVE-2026-10733GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-107332Insecure file permissions in the CodeCatalyst connection han…5.5
• CVE-2026-107333Malcolm's nginx based reverse proxy contains a URL path norm…8.1
• CVE-2026-107334Malcolm's nginx Lua role-based access control (RBAC) layer d…5.4
• CVE-2026-107336Malcolm's front nginx reverse proxy defines a "Dashboards → …6.5
• CVE-2026-107337The Malcolm kiosk Flask application exposes a POST /script_c…7.1
• CVE-2026-10734The Infility Global plugin for WordPress is vulnerable to St…7.2
• CVE-2026-10735Multiple Shapedsmart-post-show-pro WordPress plugin before 4…7.5
• CVE-2026-107352Missing authorization checks in Amazon Athena engine version…7.7
• CVE-2026-107353traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0…6.5