CVE-2026-55676

Received Received - Intake

Arbitrary PHP Code Execution in Malcolm File Upload

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the `.php` extension intact. Committed files land in `/var/www/upload/server/php/files` (`file-upload/php/config.php:7`), and the component's nginx routes any URL ending in `.php` to php-fpm. An authenticated `GET /server/php/files/<name>.php` then executes the uploaded code as `www-data`. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular `ROLE_UPLOAD` role (`nginx/lua/nginx_auth_helpers.lua:71`), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as `www-data` inside the file-upload container. Version 26.06.1 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-55676

EUVD

EUVD-2026-56948

Affected Vendors & Products

Vendor	Product	Version / Range
malcolm	network_traffic_analysis_tool_suite	to 26.06.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability affects Malcolm, a network traffic analysis tool suite. The file-upload component has a misconfiguration where the allow-list for accepted file types is empty by default, allowing all file extensions including PHP. Uploaded PHP files are stored in a directory served by nginx and php-fpm, and the server executes any uploaded PHP file as the www-data user. An authenticated user with the upload-only role can exploit this to run arbitrary PHP code within the file-upload container.

Detection Guidance

Check for unexpected PHP files in the upload directory /var/www/upload/server/php/files. Look for recently modified .php files or files with unusual names. Inspect nginx and php-fpm logs for suspicious POST requests to /server/php/submit.php.

Impact Analysis

This vulnerability allows an attacker with the upload-only role to execute arbitrary PHP code on the server running Malcolm. This could lead to full control over the server, data theft, or further network compromise. The impact includes unauthorized access, data breaches, and potential lateral movement within the network.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Non-compliance may result in legal penalties, fines, and reputational damage for organizations handling sensitive data.

Mitigation Strategies

Upgrade Malcolm to version 26.06.1 or later. Ensure the allow-list in file-upload/php/config.php is properly configured to restrict file types. Remove unnecessary roles like ROLE_UPLOAD if not required. Monitor for unauthorized PHP file uploads.

Hi! I’m here to help you understand CVE-2026-55676. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70