CVE-2026-55676: Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component
Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (file-upload/php/config.php:16), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the .php extension intact. Committed files land in /var/www/upload/server/php/files (file-upload/php/config.php:7), and the component's nginx routes any URL ending in .php to php-fpm. An authenticated GET /server/php/files/<name>.php then executes the uploaded code as www-data. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular ROLEUPLOAD role (nginx/lua/nginxauthhelpers.lua:71), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as www-data inside the file-upload container. Version 26.06.1 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
file-uploadto a version that resolves this vulnerability.Fixed in 26.06.1 - Configuration
Set the allow-list of accepted file types in file-upload/php/config.php so it is not an empty array (file-upload/php/config.php:16). Ensure PHP code extensions like .php are excluded; the current empty array default makes the type check a no-op.
FilePond PHP backend (file-upload) file type allow-list = not empty (avoid empty array default) - Configuration
In RBAC mode, prevent the granular ROLE_UPLOAD role (nginx/lua/nginx_auth_helpers.lua:71) from reaching the file upload endpoint. ROLE_UPLOAD is intended only for submitting capture files and should not be allowed to upload executable PHP.
nginx auth (nginx/lua/nginx_auth_helpers.lua) RBAC access for upload endpoint = deny ROLE_UPLOAD for /server/php/submit.php - Compensating control
Restrict network access to the file-upload container so that only authenticated users who need capture-file upload can reach POST /server/php/submit.php (the file-upload endpoint).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55676?
The severity of CVE-2026-55676 is rated as high with a score of 8.8.
How do I fix CVE-2026-55676?
To fix CVE-2026-55676, ensure that the file-upload component has a proper allow-list for accepted file types.
What type of vulnerability is CVE-2026-55676?
CVE-2026-55676 is categorized as a 'Malicious File Upload' vulnerability.
What are the potential impacts of CVE-2026-55676?
The potential impacts of CVE-2026-55676 include remote code execution due to unrestricted PHP file uploads.
Which software is affected by CVE-2026-55676?
CVE-2026-55676 affects the Malcolm file-upload component, specifically the FilePond PHP backend.