CISA Warns of Multiple Vulnerabilities in Malcolm Network Traffic Analysis Tool

CISA has published an advisory (ICSA-26-230-01) detailing multiple security vulnerabilities in Malcolm, its open-source network traffic analysis tool suite. The advisory, released on August 18, 2026, warns that successful exploitation could allow an attacker to cause a denial-of-service condition or execute arbitrary code.

The most critical vulnerability, CVE-2026-55676, affects Malcolm versions prior to 26.06.1. The file-upload component (FilePond PHP backend) fails to enforce file type restrictions due to an empty allow-list, and the filename sanitizer preserves the .php extension. An authenticated user with the upload-only role (ROLE_UPLOAD) can upload a PHP file and execute it by accessing a crafted URL, achieving arbitrary code execution as www-data inside the file-upload container.

Two additional vulnerabilities, CVE-2026-63133 and CVE-2026-63134, affect versions prior to 26.07.0. CVE-2026-63133 involves the safe-extract.py script, which extracts uploaded archives without limits on entry count, directory depth, or output size, allowing a small malicious archive to exhaust filesystem inodes and cause a denial-of-service. CVE-2026-63134 is a path traversal flaw in the same script, where directory entries with traversal sequences or absolute paths can create directories outside the intended extraction directory.

The advisory also lists CVE-2026-63177, affecting versions prior to 26.07.0, and CVE-2026-19670 and CVE-2026-19671, affecting versions up to and including 26.07.1. However, the provided text does not include detailed descriptions for these CVEs.

CISA has released fixes: Malcolm version 26.06.1 addresses CVE-2026-55676, and version 26.07.0 addresses CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177. No fix is mentioned for CVE-2026-19670 and CVE-2026-19671 in the advisory text.

Malcolm is deployed worldwide in the Information Technology critical infrastructure sector. Organizations using Malcolm should review the advisory and apply the recommended updates promptly.