CVE-2026-107333

Name of the Vulnerable Software and Affected Versions Malcolm (affected versions not specified)

Description An inconsistency in URL path normalization exists between the Lua-based role-based access control (RBAC) authorization layer and the nginx request routing logic in the reverse proxy. An authenticated user can bypass role-based restrictions by crafting a specially formatted request path to access administrative or role-gated endpoints. This issue impacts all restricted paths protected by the RBAC layer, such as the file upload, PHP server, htadmin, and authentication management interfaces.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.