PT-2026-62012

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description Role-based access control in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.request uri variable, whereas Nginx routes requests using the normalized path. An authenticated us...

PT-2026-62011

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script fails to implement traversal protection when creating directory entries using the os.makedirsos.path.joindest, entry.pathname function. An attacker can upload a malicious...

PT-2026-62010

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script extracts uploaded archives without imposing limits on the number of entries, directory depth, total entries, or output size. An attacker can use a small malicious archive...