CVE-2026-107362

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

CVE-2026-107362 Server-Side Request Forgery in Malcolm

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

CVE-2026-107362 Server-Side Request Forgery in Malcolm

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

PT-2026-108108

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description The file-upload component incorporates the FilePond PHP server, which includes an index.php file exposing a fetch API route. This route allows the server to download an arbitrary URL using cu...