CVE-2026-107362

The Malcolm file-upload component is vulnerable to a Server-Side Request Forgery (SSRF) due to its inclusion of the upstream FilePond PHP server (pqina/filepond-server-php) with largely unmodified files. Specifically, the upstream index.php contains a fetch API route that uses curl (with FOLLOWLO...