CISA Malcolm advisory: six vulnerabilities patched
CISA disclosed six vulnerabilities in the Malcolm network traffic analysis suite that could allow DoS or arbitrary code execution; patches are available.
CISA published an ICS advisory detailing six vulnerabilities affecting Malcolm, an open-source network traffic analysis tool suite maintained by CISA itself, deployed worldwide for IT/critical infrastructure monitoring. The flaws span multiple components: unsafe archive extraction (CVE-2026-63133, CVE-2026-63134) enabling denial-of-service via inode exhaustion and path traversal during file uploads; an unrestricted file upload flaw in the FilePond PHP backend (CVE-2026-55676) allowing an authenticated upload-only role to execute arbitrary PHP code as www-data; two RBAC bypass issues (CVE-2026-63177, CVE-2026-19670) caused by mismatches between how Nginx normalizes/decodes request URIs and how the Lua-based access control layer evaluates them, allowing low-privilege authenticated users to reach admin-restricted endpoints; and a decompression-bomb issue (CVE-2026-19671) where single-stream compressed uploads bypass size limits enforced on container archives, enabling resource exhaustion across the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek.
All issues require authenticated access to exploit, and most stem from inconsistent input validation or normalization between Malcolm's Nginx/Lua RBAC layer and its backend processing scripts. The vendor (CISA) has released fixes across versions 26.06.1, 26.07.0, and 26.08.0 addressing the respective CVEs. No public exploitation has been reported. Given Malcolm's role in ICS/network security monitoring and multiple independent researchers reporting these issues, organizations running the tool should prioritize upgrading to the latest patched version and review RBAC role assignments, particularly the ROLE_UPLOAD permission.
Mentioned in this report
Detection guidance
Archive Extraction Writing Files Outside Upload Directory (Zip Slip Pattern)
Detects file system writes containing path traversal sequences during archive extraction, consistent with unsafe archive-extraction handling (e.g. Malcolm CVE-2026-63133/63134) where crafted filenames inside an uploaded archive escape the intended extraction directory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Archive Extraction Writing Files Outside Upload Directory (Zip Slip Pattern)
description: Detects new files created with path traversal sequences (../) in their
target path, indicating an archive-extraction routine failed to sanitize member
filenames before writing to disk. This generalises the unsafe-extraction vulnerability
class (path traversal/inode exhaustion during upload processing) rather than a specific
exploit payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: ../
filter_common_tmp:
TargetFilename|contains:
- /tmp/
- /var/tmp/
condition: selection and not filter_common_tmp
falsepositives:
- Legitimate backup/restore tools that use relative paths within temp directories
- Package managers extracting archives with unusual but benign relative references
level: medium
id: cf5a7a49-0fe9-5015-8022-f0c7f7d85eb1
status: experimental
author: Vorant
Encoded Path Traversal Targeting Admin Endpoint (Nginx/Lua RBAC Normalization Bypass)
Detects HTTP requests using percent-encoded or double-encoded traversal/normalization tricks aimed at admin-restricted URI paths, matching the RBAC-bypass pattern where Nginx URI decoding disagrees with the Lua access-control layer's evaluation of the same request. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Encoded Path Traversal Targeting Admin Endpoint (RBAC Normalization Bypass)
description: Detects requests where the URI contains encoded traversal or normalization
tricks (%2e%2e, %252e, double slashes, semicolon path params) combined with a path
segment referencing an admin or privileged endpoint. This matches the class of vulnerability
where a front-end reverse proxy normalizes a URI differently than the backend access-control
layer, allowing low-privilege users to reach restricted routes - not a specific
CVE payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_encoding:
cs-uri-query|contains:
- '%2e%2e'
- '%252e'
- '%2f%2e%2e'
- ..;/
- //..
selection_admin_path:
cs-uri-stem|contains:
- /admin
- /api/admin
- /upload
condition: selection_encoding and selection_admin_path
falsepositives:
- Legitimate clients sending URL-encoded query parameters that happen to include dot-dot
sequences
- Automated vulnerability scanners performing authorized security testing
level: medium
id: a3c20e9f-27d6-503e-9664-71853ad0559f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free