CVE-2026-107362

Name of the Vulnerable Software and Affected Versions Malcolm (affected versions not specified)

Description The file-upload component incorporates the FilePond PHP server, which includes an index.php file exposing a fetch API route. This route allows the server to download an arbitrary URL using curl with the FOLLOWLOCATION option enabled. When a HEAD request is made, the server stores the fetched response body in the upload container's transfer directory and returns a transfer ID, allowing the caller to read back the fetched content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.