CVE-2026-107362

The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery SSRF to read HTTP, HTTPS, or FTP resources reachable from the upload...