CVE-2026-55676

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.06.1

Description The file-upload component (FilePond PHP backend) allows the upload of arbitrary files because the default allow-list for file types is empty, rendering the type check ineffective. The filename sanitizer does not remove the .php extension, and uploaded files are stored in a directory served by the same nginx and php-fpm instance. When RBAC mode is enabled, users with the ROLE UPLOAD role can access the POST /server/php/submit.php endpoint to upload malicious files. Subsequently, an authenticated request to GET /server/php/files/<name>.php executes the uploaded PHP code as the www-data user within the file-upload container.

Recommendations Update to version 26.06.1.