CISA has identified six vulnerabilities in Malcolm, its network traffic analysis tool suite, including a high-severity flaw that can let an authenticated user with an upload-only role execute arbitrary PHP code inside the file-upload container. The agency says successful exploitation could cause denial of service or arbitrary-code execution. The affected releases are addressed across Malcolm versions 26.06.1, 26.07.0, and 26.08.0, depending on the vulnerability. CISA’s advisory lists Information Technology among the affected critical-infrastructure sectors and says Malcolm is deployed worldwide.

The most severe issue, CVE-2026-55676, affects Malcolm versions before 26.06.1 and carries a CVSS 3.1 score of 8.8. The vulnerable FilePond PHP upload backend accepts files through /server/php/submit.php and stores them in a directory served by the same Nginx and PHP-FPM instance. CISA says the default file-type allow-list is empty, allowing extensions that should have been rejected, while the filename sanitizer preserves the .php extension.

An authenticated user assigned the granular ROLE_UPLOAD permission could exploit that configuration, CISA says. The role is intended for submitting capture files, but uploaded PHP files are stored in a web-served location and can be invoked through a corresponding request. The result is arbitrary PHP execution as the www-data user within the file-upload container. Malcolm 26.06.1 fixes CVE-2026-55676.

Three vulnerabilities addressed in Malcolm 26.07.0 affect archive extraction and authorization. CVE-2026-63133 carries a CVSS 3.1 score of 6.5 and concerns resource allocation during archive extraction. Before the fix, safe-extract.py imposed no limit on archive entry count, directory depth, total entries, or output size. A small malicious archive containing a very large number of entries could cause the Filebeat processing container to create unbounded filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline or another service using the same mount.

CVE-2026-63134, also fixed in 26.07.0, involves directory traversal during extraction. Although the code used libarchive’s secure flags for file extraction, CISA says directory entries were created with a raw path construction that lacked equivalent traversal protection. A malicious archive containing a ../ sequence or an absolute path could therefore cause directories to be created outside the intended extraction directory. The issue has a CVSS 3.1 score of 5.4.

The third 26.07.0 issue, CVE-2026-63177, is an authorization flaw with a CVSS 3.1 score of 7.1. Malcolm’s Nginx OpenResty Lua role-based access-control layer evaluated the raw, unnormalized request URI, while Nginx routed requests using a normalized path. CISA says an authenticated low-privilege user could prepend a traversal segment to make the authorization check miss a restricted route while Nginx directed the request to that backend.

Two additional findings are fixed in Malcolm 26.08.0. CVE-2026-19670 affects the same Lua-based authorization layer but involves percent-encoded paths. Because the RBAC check did not percent-decode the URI while Nginx used a decoded, normalized path for routing, an authenticated low-privilege user could request a restricted location with encoded characters and bypass the matching rule. The vulnerability has a CVSS 3.1 score of 5.4 and can affect paths including administrative, authentication, API, and upload endpoints.

CVE-2026-19671, also fixed in 26.08.0, addresses compressed-file handling and carries a CVSS 3.1 score of 6.5. CISA says Malcolm applied extraction limits to archive formats such as ZIP, TAR, RAR, and 7z, but not to certain single-stream compressed files, including .gz, .bz2, .xz, .lzma, and .lz. An authenticated user permitted to upload PCAP or log files could submit a highly compressed file that expands to an effectively unbounded size, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek.

CISA identifies Malcolm 26.06.1, 26.07.0, and 26.08.0 as the remediation path for the six listed CVEs. The agency recommends minimizing network exposure for control-system devices and systems, placing control-system networks and remote devices behind firewalls, and isolating them from business networks. It also advises using more secure access methods when remote access is required.