CVE-2026-107362 Server-Side Request Forgery in Malcolm

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

CVE-2026-107362

The Malcolm file-upload component is vulnerable to a Server-Side Request Forgery (SSRF) due to its inclusion of the upstream FilePond PHP server (pqina/filepond-server-php) with largely unmodified files. Specifically, the upstream index.php contains a fetch API route that uses curl (with FOLLOWLO...

CVE-2026-55676: Unrestricted Upload of File with Dangerous Type

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...