Vulnerability · Published Jul 13, 2026 · Assigned by THA-PSIRT
CVE-2026-13014Remote Code Execution vulnerability in "Suspicious" application
Critical 9.2
In plain English
A critical-severity path traversal in Suspicious from Thales CERT. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Thales CERT | Suspicious | v1.2.0 – through v1.3.4 |
Weakness: CWE-22, CWE-73, CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N