Vulnerability · Published Oct 8, 2026 · Assigned by icscert

CVE-2026-107362Server-Side Request Forgery in Malcolm

High 7.1

In plain English

A high-severity server-side request forgery in Malcolm from CISA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 63.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery (SSRF) to read HTTP, HTTPS, or FTP resources reachable from the upload container. In the default basic authentication mode this affects any authenticated user.

Affected products (as reported)

Vendor	Product	Versions
CISA	Malcolm	0 – through 26.07.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

In plain English

Official description

Affected products (as reported)

References