Six flaws in CISA's own Malcolm network tool let low-level users run code and slip past access checks

Key points

• CISA has patched six vulnerabilities in Malcolm, its free network traffic analysis tool used by critical-infrastructure defenders worldwide.
• The worst flaw, CVE-2026-55676, lets a logged-in user with only upload rights run their own code on the server; it scores 8.8 out of 10 for severity.
• Two separate bugs, CVE-2026-63177 and CVE-2026-19670, let low-privilege users reach admin-only pages by disguising the web address.
• Fixes ship in Malcolm 26.06.1, 26.07.0 and 26.08.0; anyone running an older build should update now.
• No exploitation in the wild has been reported, but the code and technical details are public on GitHub.

CISA, the US Cybersecurity and Infrastructure Security Agency, has patched six vulnerabilities in Malcolm, its own open-source network traffic analysis suite. Defenders in energy, water and IT use Malcolm to sift packet captures for signs of intrusion. Which makes bugs in it a slightly awkward look.

The advisory came out through CISA's own Cybersecurity Advisories channel. It covers five CVE entries assigned this cycle and one more that lands on top of the pile.

What actually goes wrong?

The headline bug is a classic. Malcolm's file-upload component, built on the FilePond PHP backend, was configured with an empty allow-list of accepted file types. In plain English: the check that was supposed to block dangerous uploads was blank, so it blocked nothing.

Uploaded files land in a directory served by the same web server, and any URL ending in .php gets executed. So an attacker uploads a PHP file, requests it, and their code runs as the www-data web user. This is CVE-2026-55676, rated 8.8. Under role-based access, even a user with only the upload role, meant for submitting packet captures, could trigger it.

If that sounds like an unrestricted file upload from a 2010 web-security cheat sheet, it is. Same primitive, new tool.

The access-control bugs are more interesting

Two of the flaws are variations on the same theme: the gate and the door disagree about what the address says.

Malcolm checks user permissions in a Lua script sitting in front of Nginx, the web server. But the Lua check looks at the raw web address, while Nginx decides where to route the request using a cleaned-up version of that address. Slip a /x/../ into the URL, or percent-encode a letter (/%68tadmin instead of /htadmin), and the two see different things. Nginx sends you to the admin page. The permission check, staring at a string it doesn't recognise, shrugs and lets you through.

Those are CVE-2026-63177 and CVE-2026-19670. Both are authorization bypasses via URL normalization mismatch, a bug class that has bitten plenty of reverse proxies before.

The archive bugs

The remaining three concern how Malcolm unpacks uploaded archives.

One, CVE-2026-63133, lets a small malicious archive create an unbounded number of files, exhausting the filesystem and knocking the processing pipeline offline. Another, CVE-2026-63134, is a path-traversal: a directory entry containing ../ writes files outside the extraction folder. And CVE-2026-19671 is a gzip-bomb hole: the size and depth limits that protect zip and tar extractions were not applied to single-stream compressed files like .gz or .xz.

What to patch

All six require an authenticated account, so a stolen or shared low-privilege login is the entry ticket. For teams running Malcolm on internet-exposed infrastructure, that ticket is not hard to imagine getting punched.

No public reports of exploitation in the wild have surfaced. The pull requests fixing the bugs are on GitHub, which means the technical detail is out there for anyone who wants to build a proof of concept.