CVE-2026-90444: OS Command Injection
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitrary operating system commands with the privileges of that process. This allows an attacker to read and modify ingested log data, and could provide a foothold for further movement within the internal network.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must have valid credentials for the file-transfer interface and be able to supply a crafted filename. Exploitation occurs when the automated process later uses that filename to construct and run a system command.
What level of access could successful exploitation provide?
Injected commands run with the privileges of the automated process. This can allow the attacker to read or modify ingested log data and may provide a foothold for movement within the internal network.
What should be prioritized while a permanent fix is unavailable?
Restrict access to the file-transfer interface to trusted authenticated users and prevent untrusted filenames from reaching the automated command-execution process. Review uploaded filenames and the automated process's command execution for shell metacharacters or unexpected commands.