> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CISA Malcolm - URL: https://f4n6.co.uk/security-feed/cisa-malcolm/ - Published: 2026-08-18T23:10:13.000Z - Updated: 2026-08-18T23:10:13.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-63133, CVE-2026-63134, CVE-2026-63177, CVE-2026-55676 ## 1\. Executive summary CISA published ICS advisory ICSA-26-230-01 disclosing six vulnerabilities in the Malcolm network traffic analysis tool suite, a platform EMEA financial services SOCs may deploy for packet capture and log analysis. The most severe flaw is CVE-2026-55676 (CVSS 8.8 HIGH), an unrestricted file upload allowing authenticated users holding the low-privilege `ROLE_UPLOAD` role to execute arbitrary PHP as `www-data` inside the file-upload container. Three additional HIGH-severity vulnerabilities (CVE-2026-63177, CVE-2026-19670, CVE-2026-19671) enable RBAC bypass via path normalisation or percent-encoding discrepancies, and denial-of-service via decompression bombs. None of the six CVEs are listed in CISA KEV and EPSS scores are 0%; CISA reports no known public exploitation at this time. The bottom-line risk is that any authenticated low-privilege user — or an attacker who compromises such an account — can achieve remote code execution or platform-wide denial-of-service on a Malcolm instance. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | Malcolm is a network traffic analysis tool deployed in operational SOC infrastructure; the advisory discloses exploitable flaws in a tool used for ICT-related incident management. | Clients running Malcolm must include it in their ICT resilience testing scope; verify whether current deployments match affected versions and prioritise upgrade testing. | | DORA Art. 28: ICT third-party risk — general principles | Malcolm is a CISA-produced open-source tool used as ICT third-party service infrastructure; vulnerabilities span multiple release cycles and require version-specific remediation tracking. | Clients must verify third-party tool versions against the affected ranges and track remediation across two separate vendor fixes (26.06.1, 26.07.0, 26.08.0). | ## 3\. Technical analysis & attack chain ### Prioritised triage table | CVE | Component | CVSS | KEV/EPSS | Why it matters | | -------------- | ------------------------------------------- | ---------- | ------------ | ----------------------------------------------------------------------------------------------------- | | CVE-2026-55676 | FilePond PHP upload backend | 8.8 HIGH | Not KEV / 0% | Authenticated RCE as www-data via unrestricted .php upload; reachable by lowest-privilege upload role | | CVE-2026-63177 | Nginx OpenResty Lua RBAC layer | 7.1 HIGH | Not KEV / 0% | RBAC bypass via path normalisation mismatch; low-priv user reaches admin-only backends | | CVE-2026-19670 | Nginx Lua RBAC layer (percent-encoding) | 5.4 MEDIUM | Not KEV / 0% | RBAC bypass via percent-encoded URI; admin paths reachable by low-priv users | | CVE-2026-63133 | safe-extract.py archive extraction | 6.5 MEDIUM | Not KEV / 0% | DoS via unbounded filesystem object creation from malicious archive | | CVE-2026-19671 | safe-extract.py single-stream decompression | 6.5 MEDIUM | Not KEV / 0% | DoS via decompression bomb in non-archive compressed formats (.gz, .bz2, .xz, .lzma, .lz) | | CVE-2026-63134 | safe-extract.py directory creation | 5.4 MEDIUM | Not KEV / 0% | Path traversal via ../ or absolute path in archive directory entries | **Note on the verified reference data:** The VERIFIED REFERENCE DATA supplied for this advisory covers four CVEs (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177, CVE-2026-55676). Two additional CVEs — CVE-2026-19670 and CVE-2026-19671 — appear only in the CISA advisory source text and are not present in the verified NVD/EPSS/KEV dataset. Their CVSS scores and KEV states cited above are taken solely from the CISA advisory; treat as single-sourced until NVD publication confirms. ### Attack chain — CVE-2026-55676 (RCE via unrestricted file upload) 1. **Initial access / authentication:** Attacker authenticates to Malcolm with an account holding the granular `ROLE_UPLOAD` role — a role intended only for submitting capture files. The upload endpoint is reachable by this role in RBAC mode prior to version 26.06.1 (`nginx/lua/nginx_auth_helpers.lua:71`). 2. **Upload payload:** Attacker sends `POST /server/php/submit.php` with a file bearing a `.php` extension. The file-type allow-list in `file-upload/php/config.php:16` is an empty array by default, making the type check a no-op — every extension is accepted. The filename sanitizer preserves the `.php` extension. 3. **File placement:** The uploaded file is written to `/var/www/upload/server/php/files` (configured at `file-upload/php/config.php:7`), a directory served by the same nginx and php-fpm instance. 4. **Code execution:** Attacker issues `GET /server/php/files/.php`. Nginx routes any URL ending in `.php` to php-fpm, which executes the uploaded code as user `www-data` inside the file-upload container. 5. **Impact:** Arbitrary code execution within the file-upload container. The container shares a Docker volume with OpenSearch, Logstash, Arkime, and Zeek, giving the attacker a foothold to interact with the broader Malcolm data pipeline. ### Attack chain — CVE-2026-63177 (RBAC bypass via path normalisation) 1. **Authentication:** Attacker authenticates as a low-privilege user. 2. **Crafted request:** Attacker sends a request with a traversal-segment prefix, e.g. `/x/../upload/...` or `/x/../htadmin`. The Nginx OpenResty Lua RBAC layer evaluates the raw, unnormalised `ngx.var.request_uri` for role matching. Nginx itself routes the request using the normalised path. 3. **RBAC failure:** Because the Lua layer checks the unnormalised URI, the traversal prefix causes the role check to fail to match any rule. The Lua gate falls open, granting access to the restricted backend. 4. **Impact:** Low-privilege user reaches role-restricted paths (e.g. `/htadmin`, `/auth`, `/admin_login`, `/arkime/api/esadmin`, NetBox, upload endpoints) that should be denied. ### Attack chain — CVE-2026-19670 (RBAC bypass via percent-encoding) 1. **Authentication:** Attacker authenticates as a low-privilege user. 2. **Crafted request:** Attacker requests an admin-only path using percent-encoding, e.g. `/%68tadmin.php` (percent-encoded `h`). The Lua RBAC layer pattern-matches the raw, percent-encoded URI and finds no matching restriction. Nginx selects the location block using the percent-decoded, normalised URI. 3. **RBAC failure:** The RBAC check never percent-decodes its input, so it does not recognise the restricted path. Access is granted. 4. **Impact:** Same as CVE-2026-63177 — admin-only backends reachable by low-privilege users. Fixed in version 26.08.0 via GitHub Security Advisory GHSA-jr6p-63pg-hr6g. ### Attack chain — CVE-2026-63133 (DoS via unbounded archive extraction) 1. **Upload:** Authenticated user uploads a malicious archive (zip/tar/rar/7z) containing a large number of directory or file entries. 2. **Extraction:** `safe-extract.py` (prior to v26.07.0) extracts the archive with no limit on entry count, directory depth, total entries, or output size. 3. **Resource exhaustion:** The filebeat processing container creates an unbounded number of filesystem objects, exhausting inodes or filesystem metadata on the shared mount. 4. **Impact:** Denial of service to the processing pipeline and any service sharing the same mount. ### Attack chain — CVE-2026-19671 (DoS via decompression bomb) 1. **Upload:** Authenticated user permitted to upload PCAP/log files uploads a single-stream compressed file (`.gz`, `.bz2`, `.xz`, `.lzma`, `.lz`) that is not a `.tar.*`\-style archive — e.g. a gzip bomb. 2. **Decompression:** `safe-extract.py` enforces entry-count, nesting-depth, and total-uncompressed-byte limits for container archives, but these limits do not apply to single-stream compressed formats. 3. **Resource exhaustion:** The file decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek. 4. **Impact:** Platform-wide disruption for all users. Fixed in version 26.08.0 via GHSA-f2v6-8cj4-mhr6. ### Attack chain — CVE-2026-63134 (path traversal via archive directory entries) 1. **Upload:** Authenticated user uploads a malicious archive containing a directory entry with a `../` sequence or an absolute path. 2. **Extraction:** `safe-extract.py` (prior to v26.07.0) uses libarchive's secure flags for extraction but creates directory entries via `os.makedirs(os.path.join(dest, entry.pathname))` with no traversal protection. 3. **Path traversal:** The filebeat processing container creates directories outside the intended extraction directory. 4. **Impact:** Filesystem integrity violation outside the extraction sandbox; potential for overwriting or interfering with other container paths on the shared mount. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **CVE-2026-55676 (RCE):** Upgrade Malcolm to version **26.06.1** or later immediately. This is the highest-severity flaw (CVSS 8.8 HIGH) and enables authenticated RCE. If immediate upgrade is not possible: - Restrict access to the upload endpoint (`POST /server/php/submit.php`) to trusted administrative accounts only by modifying the nginx Lua RBAC configuration. - Set the file-type allow-list in `file-upload/php/config.php:16` to a restrictive set of permitted extensions (e.g. `['pcap', 'pcapng', 'log']`), ensuring `.php` and other executable extensions are rejected. - Block nginx from routing uploaded `.php` files to php-fpm as an interim containment measure. - **Verify exposure:** Determine whether Malcolm instances are internet-facing. CISA recommends minimising network exposure and placing control system networks behind firewalls, isolated from business networks. If remote access is required, use VPN with current patches. ### P2 — Within 72 hours - **CVE-2026-63177 and CVE-2026-63134 (RBAC bypass + path traversal):** Upgrade Malcolm to version **26.07.0** (PR https://github.com/cisagov/Malcolm/pull/1043). Both flaws are fixed in this release. - **CVE-2026-63133 (DoS via archive extraction):** Also fixed in version 26.07.0\. As an interim measure, monitor filesystem inode usage on Malcolm Docker volumes and consider rate-limiting archive uploads. - **Audit RBAC assignments:** Review all users assigned `ROLE_UPLOAD` and any low-privilege roles. Revoke or restrict where the role is not operationally required. ### P3 — Within 7 days - **CVE-2026-19670 and CVE-2026-19671 (RBAC bypass via percent-encoding + decompression bomb):** Upgrade Malcolm to version **26.08.0** (GHSA-jr6p-63pg-hr6g and GHSA-f2v6-8cj4-mhr6). These CVEs appear only in the CISA advisory source; verify fix availability against the GitHub security advisories before deployment. - **Implement filesystem monitoring:** Deploy EDR or filesystem integrity monitoring on Malcolm Docker volumes to detect anomalous inode consumption or directory creation outside expected extraction paths. - **Network segmentation:** Ensure Malcolm is not accessible from untrusted networks. Place behind firewalls and restrict to SOC-internal management networks. ## 5\. Indicators of compromise No indicators of compromise available in the source material. CISA states: "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time." ### Behavioural indicators | Behaviour | Where to observe | Confidence | | -------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | -------------------------------------------- | | POST /server/php/submit.php followed by GET /server/php/files/\*.php from a ROLE\_UPLOAD user | Malcolm nginx access logs | High — derived from CVE-2026-55676 mechanism | | Requests containing /x/../ traversal prefixes to admin-only paths from low-privilege users | Malcolm nginx access logs | High — derived from CVE-2026-63177 mechanism | | Requests with percent-encoded path characters (e.g. /%68tadmin) to restricted backends | Malcolm nginx access logs | High — derived from CVE-2026-19670 mechanism | | Rapid inode exhaustion or filesystem metadata saturation on Malcolm Docker volumes | Host filesystem monitoring / Docker stats | High — derived from CVE-2026-63133 mechanism | | Large single-stream compressed file upload (.gz, .bz2, .xz, .lzma, .lz) followed by disk exhaustion on shared volume | Malcolm upload logs / Docker volume monitoring | High — derived from CVE-2026-19671 mechanism | | Directory creation outside expected extraction directory by filebeat container | Filesystem integrity monitoring / EDR | High — derived from CVE-2026-63134 mechanism | ## 6\. Detection ```yara rule Malcolm_Upload_RCE_CVE_2026_55676 : ExploitKit { meta: author = "Adverse Trace" date = "2026-08-18" reference = "https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01" description = "Detects PHP payload targeting Malcolm FilePond upload endpoint via CVE-2026-55676" strings: $endpoint = "/server/php/submit.php" ascii $filepath = "/var/www/upload/server/php/files" ascii $config1 = "file-upload/php/config.php" ascii $config2 = "nginx/lua/nginx_auth_helpers.lua" ascii $role = "ROLE_UPLOAD" ascii condition: 2 of them } ``` ```yaml title: Malcolm RBAC Bypass via Path Traversal or Percent-Encoding id: 7a3c1f2e-9b4d-4e8a-a6f1-0c2d3e4f5a6b status: experimental description: > Detects requests to Malcolm admin-only paths containing traversal segments (/x/../) or percent-encoded path characters from low-privilege users, consistent with CVE-2026-63177 and CVE-2026-19670 RBAC bypass techniques. author: Adverse Trace date: 2026/08/18 references: - https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01 logsource: product: nginx service: access detection: selection_traversal: cs-uri: - contains: "/x/../" selection_percent_encoded: cs-uri|contains: - "/%68tadmin" - "/%61dmin_login" - "/%61uth" - "/%61rkime/api/esadmin" filter_normal: user_role: "admin" condition: (selection_traversal or selection_percent_encoded) and not filter_normal falsepositives: - Legitimate administrative access using encoded URLs by admin-role users level: high ``` ```yaml title: Malcolm PHP File Upload Followed by Execution Request id: 8b4d2e3f-0c5e-4f9b-b7a2-1d3e4f5a6b7c status: experimental description: > Detects a POST to the Malcolm FilePond upload endpoint followed by a GET request to a .php file in the upload directory, consistent with CVE-2026-55676 unrestricted file upload leading to RCE. author: Adverse Trace date: 2026/08/18 references: - https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01 logsource: product: nginx service: access detection: selection_upload: cs-method: POST cs-uri|contains: "/server/php/submit.php" selection_exec: cs-method: GET cs-uri|contains|all: - "/server/php/files/" - ".php" timeframe: 10m condition: selection_upload followed by selection_exec falsepositives: - None expected; legitimate Malcolm uploads should not produce .php files level: critical ``` ## CVE assessment 4 referenced CVEs | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ---------- | --------- | ---- | --------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-55676](https://nvd.nist.gov/vuln/detail/CVE-2026-55676?ref=f4n6.co.uk) | 8.8 High | — | 0% | Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at \`POST /se… | | [CVE-2026-63177](https://nvd.nist.gov/vuln/detail/CVE-2026-63177?ref=f4n6.co.uk) | 7.1 High | — | 0% | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx Ope… | | [CVE-2026-63133](https://nvd.nist.gov/vuln/detail/CVE-2026-63133?ref=f4n6.co.uk) | 6.5 Medium | — | 0% | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with n… | | [CVE-2026-63134](https://nvd.nist.gov/vuln/detail/CVE-2026-63134?ref=f4n6.co.uk) | 5.4 Medium | — | 0% | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with lib… | ## 7\. Sources - CISA, "CISA Malcolm" ICS Advisory ICSA-26-230-01, https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01, 2026-08-18 - GitHub, cisagov/Malcolm PR #1043, https://github.com/cisagov/Malcolm/pull/1043 - GitHub, cisagov/Malcolm PR #1026, https://github.com/cisagov/Malcolm/pull/1026 - GitHub, cisagov/Malcolm Security Advisory GHSA-jr6p-63pg-hr6g, https://github.com/cisagov/Malcolm/security/advisories/GHSA-jr6p-63pg-hr6g - GitHub, cisagov/Malcolm Security Advisory GHSA-f2v6-8cj4-mhr6, https://github.com/cisagov/Malcolm/security/advisories/GHSA-f2v6-8cj4-mhr6 ## 8\. Adverse Trace position This is a **HIGH-severity advisory** driven by CVE-2026-55676 (CVSS 8.8 HIGH), which provides a straightforward authenticated RCE path from a low-privilege upload role to arbitrary code execution as `www-data` inside the Malcolm file-upload container. The RBAC bypass flaws (CVE-2026-63177, CVE-2026-19670) compound the risk by enabling privilege escalation from any authenticated low-privilege user to admin-level access. The DoS vulnerabilities (CVE-2026-63133, CVE-2026-19671) are lower severity but trivially exploitable by any authenticated user and can disrupt the entire Malcolm platform. No exploitation has been observed in the wild and all EPSS scores are 0%; however, the RCE attack chain is simple enough that exploitation upon public disclosure is plausible. EMEA financial services clients running Malcolm should treat the upgrade to 26.06.1 as an immediate P1 and plan sequential upgrades to 26.07.0 and 26.08.0\. CVE-2026-19670 and CVE-2026-19671 are single-sourced from the CISA advisory only — verify against NVD when records publish. We will monitor for KEV addition and exploitation reporting and issue an update if the threat landscape changes. --- [Read the original source →](https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*