CVE-2026-55676

Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the `.php` extension intact. Committed files land in `/var/www/upload/server/php/files` (`file-upload/php/config.php:7`), and the component's nginx routes any URL ending in `.php` to php-fpm. An authenticated `GET /server/php/files/<name>.php` then executes the uploaded code as `www-data`. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular `ROLE_UPLOAD` role (`nginx/lua/nginx_auth_helpers.lua:71`), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as `www-data` inside the file-upload container. Version 26.06.1 fixes the issue.

• CWE-434

• https://github.com/cisagov/Malcolm/releases/tag/v26.06.1
• https://github.com/cisagov/Malcolm/security/advisories/GHSA-8cvp-m7pg-qrp7

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55668File Browser provides a web file managing interface. Prior t…6.3
• CVE-2026-55669ZITADEL is an open source identity management platform. Prio…4.2
• CVE-2026-5567A flaw has been found in Tenda M3 1.0.0.10. This vulnerabili…8.8
• CVE-2026-55670ZITADEL is an open source identity management platform. Prio…2.3
• CVE-2026-55671ZITADEL is an open source identity management platform. From…2.3
• CVE-2026-55672ZITADEL is an open source identity management platform. Prio…7.4
• CVE-2026-55677Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo'…7.5
• CVE-2026-5568A vulnerability has been found in Akaunting up to 3.1.21. Th…3.5
• CVE-2026-55685React Router is a router for React. In versions 7.0.0 throug…7.5
• CVE-2026-55686Podman is a tool for managing OCI containers and pods. From …5.3
• CVE-2026-55687ESF-IDF is the Espressif Internet of Things (IOT) Developmen…7.5
• CVE-2026-55688The AsyncHttpClient (AHC) library allows Java applications t…4