CVE-2026-55676
- Source
- https://cve.org/CVERecord?id=CVE-2026-55676
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55676.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55676
- Aliases
-
- GHSA-8cvp-m7pg-qrp7
- Published
- 2026-08-11T20:24:50.803Z
- Modified
- 2026-08-14T03:51:41.198510961Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component
- Details
-
Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at
POST /server/php/submit.phpand stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (file-upload/php/config.php:16), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the.phpextension intact. Committed files land in/var/www/upload/server/php/files(file-upload/php/config.php:7), and the component's nginx routes any URL ending in.phpto php-fpm. An authenticatedGET /server/php/files/<name>.phpthen executes the uploaded code aswww-data. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granularROLE_UPLOADrole (nginx/lua/nginx_auth_helpers.lua:71), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP aswww-datainside the file-upload container. Version 26.06.1 fixes the issue. - Database specific
{ "cwe_ids": [ "CWE-434" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55676.json", "cna_assigner": "GitHub_M" }- References