CVE-2026-55676 Overview
CVE-2026-55676 is an unrestricted file upload vulnerability [CWE-434] in Malcolm, a network traffic analysis tool suite maintained by CISA. The FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The upload endpoint enforces no file-type allow-list and preserves the .php extension. An authenticated attacker holding the ROLE_UPLOAD role can upload a PHP file and then request it, causing arbitrary code execution as www-data inside the file-upload container. Malcolm version 26.06.1 addresses the flaw.
Critical Impact
Authenticated users with the low-privilege ROLE_UPLOAD role can achieve remote code execution as www-data inside the Malcolm file-upload container.
Affected Products
- CISA Malcolm network traffic analysis suite prior to v26.06.1
- Malcolm deployments running in RBAC mode with the ROLE_UPLOAD role assigned
- The FilePond PHP backend component (file-upload/php/config.php)
Discovery Timeline
- 2026-08-11 - CVE CVE-2026-55676 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-55676
Vulnerability Analysis
The vulnerability resides in Malcolm's file-upload component, which wraps the FilePond PHP backend. Uploads are accepted at POST /server/php/submit.php and committed to /var/www/upload/server/php/files. This directory is served by the same nginx instance that proxies any URL ending in .php to php-fpm.
An attacker with the ROLE_UPLOAD role, intended solely for submitting packet capture files, can upload a PHP web shell. A subsequent authenticated GET /server/php/files/<name>.php invokes php-fpm and executes the attacker-controlled code as the www-data user inside the container. This grants a foothold for lateral movement, data exfiltration, or tampering with capture data ingested by Malcolm.
Root Cause
Two defects combine to enable exploitation. First, the file-type allow-list at file-upload/php/config.php:16 is defined as an empty array by default, so the extension check is a no-op that accepts every filename. Second, the filename sanitizer preserves the .php extension rather than stripping or renaming dangerous extensions. Because the storage directory is served by nginx and mapped to php-fpm, uploaded PHP files become directly executable.
Attack Vector
Exploitation requires network access to the Malcolm web interface and valid credentials mapped to ROLE_UPLOAD. The role check at nginx/lua/nginx_auth_helpers.lua:71 permits this granular role to reach the upload endpoint. The attacker submits a .php file via the FilePond upload API, then issues an authenticated GET request against the stored file path to trigger execution. No user interaction is required beyond the initial authentication of the attacker's session.
See the GitHub Security Advisory GHSA-8cvp-m7pg-qrp7 for the vendor's technical description.
Detection Methods for CVE-2026-55676
Indicators of Compromise
- Files with .php, .phtml, or .phar extensions present in /var/www/upload/server/php/files inside the file-upload container.
- HTTP POST requests to /server/php/submit.php followed by GET requests to /server/php/files/*.php from the same authenticated session.
- Unexpected outbound network connections initiated by the www-data process inside the file-upload container.
- Shell utilities (sh, bash, curl, wget, nc) spawned as children of php-fpm workers.
Detection Strategies
- Inspect nginx access logs for successful GET requests to any .php URI under /server/php/files/.
- Alert on FilePond uploads whose filenames end in server-executable extensions such as .php, .phtml, .phar, or .pht.
- Correlate ROLE_UPLOAD session activity with subsequent process execution or file writes inside the file-upload container.
Monitoring Recommendations
- Enable container runtime telemetry for the file-upload container and forward process, file, and network events to a SIEM.
- Baseline the expected file extensions submitted by legitimate capture-file workflows and alert on deviations.
- Monitor authentication logs for accounts assigned the ROLE_UPLOAD role, particularly newly created or dormant accounts that suddenly submit uploads.
How to Mitigate CVE-2026-55676
Immediate Actions Required
- Upgrade Malcolm to version 26.06.1 or later, available from the Malcolm v26.06.1 release page.
- Audit user role assignments and remove ROLE_UPLOAD from any account that does not require capture-file submission.
- Inspect /var/www/upload/server/php/files for unexpected .php or other executable files and remove any that are not legitimate uploads.
- Rotate credentials for accounts that held ROLE_UPLOAD prior to patching.
Patch Information
Malcolm v26.06.1 fixes the vulnerability by enforcing a proper file-type allow-list and ensuring uploaded filenames cannot retain executable extensions. Release notes and the fixed artifacts are published at the Malcolm v26.06.1 release page. Administrators should follow the standard Malcolm upgrade procedure and validate the file-upload container image tag after deployment.
Workarounds
- Restrict network access to the Malcolm web interface to trusted management networks only.
- Reconfigure nginx to prevent execution of .php files under /server/php/files/ by mapping the location to a static file handler.
- Temporarily disable the FilePond upload endpoint if capture-file submission is not required in the environment.
- Enforce least privilege by removing the ROLE_UPLOAD role from all users until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
