CVE-2026-63133

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0

Description The safe-extract.py script extracts uploaded archives without imposing limits on the number of entries, directory depth, total entries, or output size. An attacker can use a small malicious archive with an excessive number of directory or file entries to force the filebeat processing container to create an unbounded number of filesystem objects. This leads to the exhaustion of inodes (data structures that store information about files and directories) or filesystem metadata, resulting in a denial of service for the processing pipeline and any other service sharing the same mount.

Recommendations Update to version 26.07.0.