CVE-2026-55676

creationtimestamp| type| source ---|---|--- 2026-08-11 22:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mstmihp3qw27 2026-08-18 20:07:19+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mtezer436f2m 2026-08-21 20:10:59+00:00| seen|...

CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

CVE-2026-55676

Malcolm’s file-upload PHP backend allows unrestricted uploads: an empty allow-list means any extension is accepted, and the filename sanitizer preserves .php. Uploaded files land under /var/www/upload/server/php/files and are served via nginx to php-fpm, enabling an authenticated GET to execute t...