Cisagov Malcolm
6 CVEs affecting Cisagov Malcolm. Latest disclosed: 2026-08-18. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55676 | High | 8.8 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores… |
CVE-2026-63177 | High | 7.1 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the r… |
CVE-2026-19671 | Medium | 6.5 | 2026-08-18 | Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting containe… |
CVE-2026-63133 | Medium | 6.5 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, director… |
CVE-2026-19670 | Medium | 5.4 | 2026-08-18 | Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin… |
CVE-2026-63134 | Medium | 5.4 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but crea… |