Six flaws in CISA's own Malcolm network tool let low-level users run code and slip past access checks

Key points

• CISA has patched six vulnerabilities in Malcolm, its free network traffic analysis tool used by critical-infrastructure defenders worldwide.
• The worst flaw, CVE-2026-55676, lets a logged-in user with only upload rights run their own code on the server; it scores 8.8 out of 10 for severity.
• Two separate bugs, CVE-2026-63177 and CVE-2026-19670, let low-privilege users reach admin-only pages by disguising the web address.
• Fixes ship in Malcolm 26.06.1, 26.07.0 and 26.08.0; anyone running an older build should update.
• No exploitation in the wild has been reported, but the code and technical details are public on GitHub.

CISA has patched six vulnerabilities in Malcolm, its own open-source network traffic analysis suite. Defenders in energy and IT use Malcolm to sift packet captures for signs of intrusion. Which makes bugs in it a slightly awkward look.

The advisory came through CISA's Cybersecurity Advisories channel. It covers six CVE entries across three patched releases.

What actually goes wrong?

The headline bug is a classic. Malcolm's file-upload component, built on the FilePond PHP backend, was configured with an empty allow-list of accepted file types. The check that was supposed to block dangerous uploads was blank, so it blocked nothing.

Uploaded files land in a directory served by the same web server. Any URL ending in .php gets executed, so an attacker uploads a PHP file, requests it, and their code runs as the www-data web user. This is CVE-2026-55676, rated 8.8. Even a user holding only the upload role, meant for submitting packet captures, could trigger it. If that sounds like an unrestricted file upload from a 2010 web-security cheat sheet, that's because it is.

The access-control bugs are more interesting

Two flaws are variations on the same theme: the gate and the door disagree about what the address says.

Malcolm checks user permissions in a Lua script sitting in front of Nginx, the web server. The Lua check looks at the raw web address, while Nginx routes using a cleaned-up version. Slip a /x/../ into the URL and the two see different things. Nginx sends you to the admin page; the permission check, staring at a string it can't match, lets you through.

Percent-encoding works the same way: request /%68tadmin instead of /htadmin and the Lua gate finds no matching restriction. Those are CVE-2026-63177 and CVE-2026-19670. Both are authorization bypasses via URL normalization mismatch, a bug class that has bitten plenty of reverse proxies before.

The archive bugs

The remaining three concern how Malcolm unpacks uploaded archives.

CVE-2026-63133 lets a small malicious archive create an unbounded number of files, exhausting the filesystem and knocking the processing pipeline offline. CVE-2026-63134 is a path-traversal: a directory entry containing ../ writes files outside the extraction folder. CVE-2026-19671 is a gzip-bomb hole, where the size limits that protect zip and tar extractions were not applied to single-stream compressed files such as .gz or .xz.

What to patch

All six require an authenticated account, so a stolen or shared low-privilege login is the entry ticket. For teams running Malcolm on internet-exposed infrastructure, that ticket isn't hard to imagine getting punched.

No public reports of exploitation have surfaced. The pull requests fixing the bugs are on GitHub, which means the technical detail is out there for anyone who wants to build a proof of concept. When CISA is both the vendor and the agency urging defenders to patch promptly, the advisory writes its own punchline. Watch whether the GitHub diffs accelerate any exploitation timeline, because with six CVEs and public code this is exactly the scenario where a working exploit arrives faster than most teams cycle their updates.