Six Vulnerabilities Affect CISA Malcolm: Risk of Arbitrary Code Execution and Service Disruption

Six flaws in the traffic analysis suite

CISA today, August 18, 2026, disclosed six vulnerabilities in the CISA Malcolm suite, a platform used for network traffic analysis. The impacts range from denial of service to arbitrary PHP code execution and unauthorized access to administrative backends.

The vulnerabilities affect several product versions:

• CVE-2026-55676: Malcolm versions prior to 26.06.1;
• CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177: Malcolm versions prior to 26.07.0;
• CVE-2026-19670 and CVE-2026-19671: Malcolm 26.07.1 and earlier.

All listed versions are classified as known_affected. CISA reports an overall CVSS score of 8.8, although severity varies across the individual flaws.

The source does not indicate whether these vulnerabilities are included in the CISA Known Exploited Vulnerabilities (KEV) catalog. Consequently, no catalog inclusion date or associated remediation deadline is available.

An upload can lead to PHP code execution

The most severe vulnerability is CVE-2026-55676, rated CVSS 3.1: 8.8. It affects the FilePond PHP backend used to handle uploads.

The component accepts files through:

POST /server/php/submit.php

and stores them in a directory exposed by the same Nginx and php-fpm instance:

/var/www/upload/server/php/files

By default, no restrictions are applied to permitted file extensions. In addition, sanitization preserves the .php extension. An authenticated low-privileged user can therefore upload a PHP file and later request it through:

GET /server/php/files/.php

Nginx rules forward URLs with a .php extension to php-fpm, causing the code to execute with the privileges of the www-data user.

The issue is particularly significant in RBAC configurations. Before version 26.06.1, the granular ROLE_UPLOAD role, intended to permit only the upload of capture files, could access the vulnerable endpoint. An account authorized solely to upload files could therefore execute arbitrary code inside the file-upload container.

The CVSS vector indicates remote access, low complexity, and authentication with low privileges:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The fix is available in version 26.06.1.

Unsafe extraction: traversal and unlimited resource consumption

Three vulnerabilities affect the safe-extract.py script, which processes archives uploaded to the platform.

CVE-2026-63133 enables a resource-exhaustion attack. In versions prior to 26.07.0, the script did not adequately limit the number of items, directory depth, total number of entries, or output size.

A small archive can contain an enormous number of files and directories. During extraction, the filebeat container may create an unlimited number of filesystem objects, consuming inodes or metadata. The processing pipeline may then become unavailable, potentially affecting other services that share the same mount.

The vulnerability has a CVSS 3.1 score of 6.5:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The fix is available starting with version 26.07.0.

CVE-2026-63134 concerns a directory traversal issue during extraction. Although Malcolm uses libarchive security flags, directories are created through a path constructed with:

os.makedirs(os.path.join(dest, entry.pathname))

This operation does not adequately prevent the use of ../ sequences or absolute paths. An attacker-crafted archive could therefore cause the filebeat container to create directories outside the intended area.

The CVSS 3.1 score is 5.4, with an impact on integrity and availability. This flaw is also fixed in version 26.07.0.

The third vulnerability in this group is CVE-2026-63177, an RBAC bypass caused by inconsistent path handling between Nginx and OpenResty Lua. The Lua check analyzes the raw value of ngx.var.request_uri, while Nginx selects the backend using a normalized path.

An authenticated low-privileged user can prepend a traversal sequence, for example:

/x/../upload/...

Nginx may route the request to the restricted backend, while the Lua check fails to identify the applicable rule. When no rule matches, access is allowed rather than denied.

The flaw has a CVSS 3.1 score of 7.1 and is fixed in version 26.07.0.

Encoding and compressed files bypass additional defenses

CVE-2026-19670 affects Malcolm 26.07.1 and earlier and exploits a discrepancy between RBAC checks and Nginx routing.

The Lua layer performs pattern matching against the raw, percent-encoded URI. Nginx, however, decodes and normalizes the path before selecting the location block.

An authenticated low-privileged user can encode parts of the URL, for example:

/%68tadmin.php

Nginx interprets the value as an administrative path, while the RBAC check does not recognize the restriction because the URI is still encoded. Exposed endpoints include /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, and upload paths.

The vulnerability has a CVSS 3.1 score of 5.4. No specific fixed version is listed.

Finally, CVE-2026-19671 concerns a decompression bomb involving single-stream compressed files. The limits applied through libarchive to ZIP, TAR, RAR, and 7z archives are not applied in the same way to:

• .gz;
• .bz2;
• .xz;
• .lzma;
• .lz.

A user authorized to upload PCAP or log files can submit a very small but highly compressible file. During processing, its contents may expand without an effective limit, consuming space on the Docker volume shared by OpenSearch, Logstash, Arkime, and Zeek.

This can interrupt the platform for all users. The flaw has a CVSS 3.1 score of 6.5. No specific fixed version is listed for this issue either.

What administrators should do

The priority is to upgrade Malcolm to at least the available fixed versions:

• 26.06.1 for CVE-2026-55676;
• 26.07.0 for CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177.

For CVE-2026-19670 and CVE-2026-19671, vulnerable versions include 26.07.1, but no remediating release is specified. Administrators should therefore check for available updates and temporarily restrict access to the affected endpoints.

Organizations should minimize the number of accounts authorized to upload files, review RBAC roles, and inspect logs for uploads, requests containing encoded paths or ../, and unusual access to administrative endpoints.

They should also monitor Docker volume usage, inode consumption, and metadata, along with restarts or errors involving the file-upload and filebeat containers. No specific indicators of compromise have been reported.

CISA recommends avoiding direct Internet exposure, placing systems behind firewalls, isolating control networks from corporate networks, and using up-to-date VPNs for remote access. These measures should be evaluated against the installation’s operational requirements.