CISA Advises on Multiple Vulnerabilities in Malcolm Network Analysis Tool
CISA has issued an advisory detailing several critical vulnerabilities in the Malcolm network traffic analysis tool, potentially allowing for denial-of-service or arbitrary code execution.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an advisory highlighting multiple vulnerabilities discovered in the Malcolm network traffic analysis tool. These flaws, affecting various versions of the software, could permit attackers to achieve denial-of-service conditions or execute arbitrary code on affected systems.
The vulnerabilities stem from issues within the archive extraction and file upload components of Malcolm. Specifically, CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177, present in versions prior to 26.07.0, are related to how the safe-extract.py script handles uploaded archives. These flaws can lead to resource exhaustion by creating an unbounded number of filesystem objects, thereby denying service to the processing pipeline. Additionally, improper handling of directory entries within archives could allow for path traversal, enabling attackers to create directories outside the intended extraction location.
Another significant vulnerability, CVE-2026-55676, impacts versions prior to 26.06.1. This flaw resides in the file-upload component, specifically the FilePond PHP backend. Due to a misconfiguration in the allow-list for accepted file types and the preservation of .php extensions by the filename sanitizer, an attacker could upload and execute arbitrary PHP code. This is particularly concerning as the upload endpoint is accessible via the granular ROLE_UPLOAD in RBAC mode, allowing users with only upload privileges to execute code as the www-data user.
Furthermore, CVE-2026-63177, also affecting versions prior to 26.07.0, involves an authorization bypass within the Role-Based Access Control (RBAC) enforcement layer. This vulnerability arises from the evaluation of raw, unnormalized request URIs by the Nginx OpenResty Lua layer, while Nginx itself uses normalized paths for routing. An authenticated low-privilege user can exploit this discrepancy by prepending traversal segments to requests, tricking Nginx into routing to a restricted backend while the Lua role check fails to identify the malicious intent, thus granting unauthorized access.
CISA has assigned a CVSS v3.1 base score of 8.8 (HIGH) to CVE-2026-55676, reflecting its potential for high impact, including confidentiality, integrity, and availability. Other vulnerabilities also carry significant CVSS scores, indicating a broad range of potential risks.
CISA strongly advises users to update their Malcolm installations to the patched versions. Version 26.07.0 addresses CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177, while version 26.06.1 resolves CVE-2026-55676. Users can find detailed information and remediation guidance, including links to pull requests on GitHub, within the official CISA advisory.
Malcolm is a critical tool for network traffic analysis, deployed worldwide across various critical infrastructure sectors, including information technology. The successful exploitation of these vulnerabilities could have severe consequences, ranging from service disruption to complete system compromise, underscoring the importance of prompt patching and security vigilance.