CVE-2026-107362

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107362
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107362.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107362
Aliases
  • GHSA-cvx2-hj33-vc4q
Published
2026-10-08T17:25:23Z
Modified
2026-10-10T02:47:27Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVSS Calculator
Summary
Server-Side Request Forgery in Malcolm
Details

Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched response body in the upload container's transfer directory and returns the transfer ID to the caller, enabling full readback of the fetched content.

Database specific 
{
    "cna_assigner": "icscert",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107362.json"
}
References

Affected packages

Git / github.com/cisagov/malcolm

Affected ranges

Type
GIT
Repo
https://github.com/cisagov/malcolm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
2c19ef04d85230634ac70cc68b8f418a0666afec
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "26.07.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.7.0
v1.7.1
v1.7.1a
v1.7.2
v1.8.0
v1.8.1
v2.*
v2.0.0
v2.0.0-pre1
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.3.0
v2.4.0
v2.4.0.1
v2.4.1
v2.4.2
v2.5.0
v2.6.0
v2.6.1
v26.*
v26.05.2
v26.06.0
v26.06.1
v26.07.0
v26.07.1
v3.*
v3.0.0
v3.0.1
v5.*
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v6.*
v6.4.0
v6.4.1
v6.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107362.json"