CVE-2026-55676

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at "POST /server/php/submit.php" and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array...