CVE-2026-90453: Security vulnerability
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be redirected to an arbitrary external destination after completing an upload.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and able to submit a request to the affected file-upload handler. Exploitation relies on supplying a Referer header containing an external URL.
Who can be affected by the redirect?
Another authenticated user's browser can be redirected to an attacker-chosen external destination after an upload completes. The described impact is browser redirection rather than unauthorized file access or modification.