Loading today’s stories
Security1 distinct publisher3 min readUpdated
CISA's advisory for its own network traffic analysis suite lists denial of service and arbitrary code execution: unbounded archive extraction, traversal in two layers, and uploads that run PHP as www-data.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
CISA has published an advisory covering six CVEs in Malcolm, the network traffic analysis tool suite it ships itself, warning that successful exploitation could cause a denial-of-service condition or allow arbitrary code execution [1] [2] [3] [4]. The suite is deployed worldwide and categorised under the Information Technology critical infrastructure sector, which is to say the affected installs are mostly other people's monitoring stacks [5].
The most consequential item for anyone running Malcolm on shared storage is the extraction logic. Before version 26.07.0, `safe-extract.py` unpacked uploaded archives with no limit on entry count, directory depth, total entries, or output size [6]. A small malicious archive stuffed with directory or file entries makes the filebeat processing container create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service not only to the processing pipeline but to any service sharing the same mount [7]. CISA classifies it as CWE-770, allocation of resources without limits or throttling [8]. The blast radius is the interesting part: the collateral is whatever else you colocated on that volume.
The same script had a second problem. File extraction was protected by libarchive's secure flags, but directory entries were created with a raw `os.makedirs(os.path.join(dest, entry.pathname))` and no traversal protection, so an archive containing a `../` sequence or an absolute path in a directory entry creates directories outside the intended extraction target [9].
The code execution path runs through the file-upload component. Its FilePond PHP backend accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance [10]. The allow-list meant to restrict file types is an empty array by default, making the type check a no-op that accepts every extension, and the filename sanitizer leaves `.php` intact [11]. Committed files land under `/var/www/upload/server/php/files`, the component's nginx routes any URL ending in `.php` to php-fpm, and an authenticated GET then runs the uploaded code as `www-data` [12]. Before 26.06.1, in RBAC mode, that endpoint was reachable by the granular `ROLE_UPLOAD` role, intended only for submitting capture files, so a user holding upload-only rights got arbitrary PHP execution inside the file-upload container [13].
RBAC itself fell open elsewhere. The role checks enforced in the nginx OpenResty Lua layer evaluated the raw, unnormalized `ngx.var.request_uri` while nginx routed on the normalized path, so an authenticated low-privilege user could prepend a traversal segment such as `/x/../upload/...` and have nginx deliver the request to a restricted backend while the Lua rule matched nothing and allowed it [14].
Version 26.06.1 fixes the upload flaw and 26.07.0 fixes the extraction and RBAC issues, with CISA pointing to pull requests 1026 and 1043 respectively [15]. Two of the six, CVE-2026-19670 and CVE-2026-19671, are listed as affecting versions up to and including 26.07.1, and the advisory material supplied contains no description of them and no named fixed version [16].
Watch for a release above 26.07.1 and for detail on those two open CVEs; until then, the honest read is that the current version is still listed as affected. Operators should also check whether their Malcolm mount is shared with anything they would miss.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.request_uri while Nginx routes requests using the normalized path; an authenticated low-privilege user can prepend a traversal segment (for example /x/../upload/...) so Nginx routes the request to a restricted backend while the Lua role check matches no rule and falls open. Version 26.07.0 fixes the issue.
CISA advisory summary: successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code.
Affected versions listed: Malcolm <26.06.1 (CVE-2026-55676); Malcolm <26.07.0 (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177); Malcolm <=26.07.1 (CVE-2026-19670, CVE-2026-19671).
Malcolm is a network traffic analysis tool suite, and the affected product is listed as CISA Malcolm with CISA as vendor.
Background section: critical infrastructure sector Information Technology; countries/areas deployed worldwide; company headquarters location United States.
Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Primary vendor advisory with code-level specifics
Every substantive claim traces to the issuing vendor's own advisory, which names scripts, config file line numbers, the Lua auth helper line, exploit shapes, CWE mappings, and public pull requests. That is strong first-party evidence for the existence and mechanism of the defects. It is capped below the top band because the cluster has exactly one publisher, no independent verification, no CVSS metrics despite metrics headings, and the final vulnerability entry is truncated.
Fixes shipped; field exposure and patch uptake unmeasured
Concrete adoption-relevant activity exists on the supply side: three remediating releases (26.06.1, 26.07.0, and 26.08.0 for the percent-encoding bypass) are documented with pull request and GHSA references. On the demand side the advisory offers only a boilerplate 'worldwide' deployment field with no install counts, named operators, telemetry, or exploitation-in-the-wild statement, so real-world exposure and patch uptake cannot be sized from this material.
Roughly aligned, slight completeness overreach
The framing tracks the advisory closely: denial of service and arbitrary code execution are the vendor's own words, and the archive-bomb-starves-shared-mounts characterisation is a direct restatement of the CWE-770 entry. The small positive gap comes from breadth rather than substance: 'six CVEs' counts two identifiers whose treatment in the supplied text is thin or truncated, and no exploitation-in-the-wild evidence backs the code-execution impact, which remains a capability statement.
Vendor and advisory publisher are the same body
CISA authored the advisory about a product for which CISA is listed as the vendor, so disclosure, severity characterisation, and remediation framing all come from the party whose code is affected. That is a genuine structural incentive to lead with available fixes, and it explains the absence of interim mitigations and of any exploitation-status discussion. It is mid-range rather than high because the disclosure is unusually self-critical, names its own files and line numbers, and links public pull requests that third parties can inspect.
High on mechanism, lower on scope and impact
Confidence in what the defects are and how they were fixed is high, because the primary source is the vendor and the detail is code-level. Confidence in scope, severity ranking, and real-world consequence is materially lower: one publisher, empty metrics sections, no exploitation data, one contested claim about the two open CVEs, and a body that ends mid-sentence.
build
A UDP packet is now enough: IKEEXT RCE moves from patch queue to fire drill1 distinct publisher
security
The ransom is for silence now, and your restore drill does not price that1 distinct publisher
build
GitLab bundles a zero-click GraphQL flaw with a CSRF bug, and only one needs a victim1 distinct publisher
security
CDN Tsunami: the protocol translation you pay for is the amplifier1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 18, 2026