CVE-2026-13014: Thales CERT Suspicious App RCE Vulnerability

CVE-2026-13014 Overview

CVE-2026-13014 is a path traversal vulnerability [CWE-22] affecting the Thales CERT Suspicious application in versions <= 1.3.4. The flaw, named "Matryoshka Mail," allows a remote and unauthenticated attacker to overwrite writable application files and execute arbitrary code inside the Django application container. Attackers can target Python modules, configuration files, cron inputs, and runtime artifacts to achieve root-level code execution. The impact includes persistent denial of service, compromise of application secrets, and abuse of integrated third-party services. Thales PSIRT credits Lucien Doustaly (aka wlayzz) with the discovery.

Critical Impact
Unauthenticated remote attackers can overwrite arbitrary files and gain root-level code execution inside the Django application container.

Affected Products

Thales CERT Suspicious application versions <= 1.3.4
Django-based container deployments of the Suspicious application
Environments integrating the Suspicious application with external secrets or services

Discovery Timeline

Vulnerability discovered and reported by Lucien Doustaly (aka wlayzz)
2026-07-13 - CVE-2026-13014 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-13014

Vulnerability Analysis

The vulnerability stems from improper limitation of a pathname to a restricted directory [CWE-22]. The Suspicious application processes attacker-controlled input used to construct file system paths without adequate sanitization. Attackers can craft input containing directory traversal sequences to escape the intended write directory. Because the affected files include Python modules loaded by the Django runtime, arbitrary file overwrite escalates directly into arbitrary code execution.

The attack requires no authentication and can be triggered over the network. Once an attacker replaces a Python module or configuration file, the next execution loads attacker-controlled code with the privileges of the container process, which runs as root. Overwriting cron inputs establishes persistence, while modifying integration configuration exposes stored secrets and API tokens.

Root Cause

The application concatenates or joins untrusted input into destination file paths without canonicalizing the resulting path or verifying it stays within the intended write directory. Traversal sequences such as ../ allow the write to reach any location the process can access.

Attack Vector

An unauthenticated remote attacker submits crafted input to the vulnerable ingest interface of the Suspicious application. The payload directs the file write into sensitive locations such as Django project directories, /etc/cron.d/, or configuration files. Refer to the GitHub Security Advisory GHSA-x85x-9mrm-wwvp for technical details.

// No verified public exploit code is available.
// See vendor advisory for technical detail.

Detection Methods for CVE-2026-13014

Indicators of Compromise

Unexpected modifications to Python source files, .pyc bytecode, or settings.py inside the Suspicious application container
New or altered entries under /etc/cron.d/, /etc/crontab, or user crontab files inside the container
HTTP request logs containing traversal sequences such as ../ or URL-encoded variants targeting the Suspicious ingest endpoints
Outbound connections from the Django container to unexpected hosts following a file upload or ingest event

Detection Strategies

Monitor the container filesystem for write events outside expected upload or working directories using file integrity monitoring
Alert on Django worker processes spawning shells, package managers, or network utilities such as curl, wget, or bash
Inspect web access logs for path traversal patterns in request bodies and query strings directed at the Suspicious application

Monitoring Recommendations

Baseline the container image contents and alert on drift for Python modules and configuration files
Forward Django application and container runtime logs to a centralized SIEM for correlation across web, filesystem, and process telemetry
Track outbound network activity from the container and alert on connections not associated with known integrations

How to Mitigate CVE-2026-13014

Immediate Actions Required

Upgrade the Thales CERT Suspicious application to a version above 1.3.4 as published in the GitHub Security Advisory
Restrict network access to the Suspicious application to trusted analyst networks until patching is complete
Rotate all secrets, API tokens, and integration credentials stored in or accessible to the application
Rebuild the container from a known-good image to remove any attacker-modified files or persistence

Patch Information

Thales has published a security advisory tracking this issue as GHSA-x85x-9mrm-wwvp. Refer to the Thales CERT Suspicious repository advisory for the fixed release and upgrade guidance.

Workarounds

Place the application behind a reverse proxy or web application firewall that blocks path traversal sequences in request bodies and parameters
Run the Django container as a non-root user and mount application code as read-only where possible
Apply container-level filesystem restrictions to prevent writes outside a dedicated ingest directory

bash

# Example: run the container with a read-only root filesystem and a writable tmpfs
docker run --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  --user 1000:1000 \
  --cap-drop ALL \
  suspicious:patched