CVE-2026-55676 cisagov CVE debrief

Who should care

Users of Malcolm network traffic analysis tool suite, particularly those with the ROLE_UPLOAD role, should assess exposure and apply version 26.06.1 or later. The vulnerability allows an authenticated user to execute arbitrary PHP code as www-data inside the file-upload container, potentially leading to code execution and data tampering. Users should review and apply the patch, restrict access to the file-upload component, and monitor for suspicious

Why it matters

CVE-2026-55676 is a high severity vulnerability in Malcolm's file-upload component, allowing arbitrary PHP execution as www-data. Users with the ROLE_UPLOAD role are affected. The issue is fixed in version 26.06.1.

• Arbitrary PHP execution as www-data in the file-upload container
• Potential for code execution and data tampering
• Need for version 26.06.1 or later for fix
• Verification of ROLE_UPLOAD role restrictions required

Technical summary

The file-upload component in Malcolm network traffic analysis tool suite has a vulnerability allowing arbitrary PHP execution as www-data due to an empty allow-list for file types and a filename sanitizer that keeps the .php extension intact. The vulnerability has a high severity score of 8.8 and is fixed in version 26.06.1. An authenticated user can execute arbitrary PHP code as www-data inside the file-upload container, potentially leading to code execution and data tampering. The CVE Program and NVD records provide

Defensive priority

High priority for users of Malcolm network traffic analysis tool suite

Recommended defensive actions

• Review and apply version 26.06.1 or later for Malcolm
• Restrict access to the file-upload component
• Monitor for suspicious activity in the file-upload container
• Verify ROLE_UPLOAD role restrictions
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

Evidence from CVE Program and NVD records indicates a vulnerability in Malcolm's file-upload component, allowing arbitrary PHP execution as www-data. The issue is fixed in version 26.06.1. The CVE Program and NVD records provide details on the vulnerability, including its severity score of 8.8 and the affected product versions. The vulnerability is caused by an empty allow-list for file types and a filename sanitizer that keeps the .php extension intact. This allows an authenticated user to execute arbitrary PHP code as www-data

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.