Deathripper21

**Name of the Vulnerable Software and Affected Versions** Malcolm versions prior to 26.06.1 **Description** The file-upload component (FilePond PHP backend) allows the upload of arbitrary files because the default allow-list for file types is empty, rendering the type check ineffective. The filename sanitizer does not remove the `.php` extension, and uploaded files are stored in a directory served by the same nginx and php-fpm instance. When RBAC mode is enabled, users with the `ROLE UPLOAD` role can access the `POST /server/php/submit.php` endpoint to upload malicious files. Subsequently, an authenticated request to `GET /server/php/files/<name>.php` executes the uploaded PHP code as the `www-data` user within the file-upload container. **Recommendations** Update to version 26.06.1.