CVE-2026-107362GHSA-cvx2-hj33-vc4q
Server-Side Request Forgery in Malcolm
CISA Malcolm
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 8 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Reports 1
1 outlet mention it. Reports are not confirmation; each links to its source.
Description
Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched response body in the upload container's transfer directory and returns the transfer ID to the caller, enabling full readback of the fetched content.
Text from CVE List
Affected versions 2
- Malcolmaffected: all versions through 26.07.1CVE List
- Malcolmunaffected: 26.08.0CVE List