CVE-2026-55676

creationtimestamp| type| source ---|---|--- 2026-08-11 22:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mstmihp3qw27 2026-08-18 20:07:19+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mtezer436f2m 2026-08-21 20:10:59+00:00| seen|...

CVE-2026-55676

Malcolm’s file-upload PHP backend allows unrestricted uploads: an empty allow-list means any extension is accepted, and the filename sanitizer preserves .php. Uploaded files land under /var/www/upload/server/php/files and are served via nginx to php-fpm, enabling an authenticated GET to execute t...