Malcolm contains a critical unrestricted file upload vulnerability that allows an authenticated attacker to execute arbitrary code on the server.

The vulnerability is identified as CWE-434, an unrestricted upload of a file with a dangerous type. An attacker with low-level privileges (PR:L) can upload malicious files to the server, which can then be executed to compromise the system.

Successful exploitation allows an attacker to gain remote code execution capabilities on the Malcolm server. This can lead to total system compromise, unauthorized access to sensitive network traffic data stored within the suite, and potential lateral movement across the network. The CVSS score of 8.8 highlights the severity of this access control failure.

Immediate Action: Update your Malcolm instance to version 26.06.1 or later to implement the necessary file type restrictions.

Proactive Monitoring: Review web server logs for uploads of unusual file extensions and monitor for unexpected process creation or outbound network connections from the Malcolm service account.

Compensating Controls: Restrict access to the Malcolm management interface to trusted administrative networks and configure the underlying web server to prevent the execution of files within the upload directories.

Public Exploit Available: No (exploit_available: false)

Administrators must prioritize updating to version 26.06.1 to address this file upload vulnerability. Given the sensitive nature of network traffic analysis tools, securing the platform against unauthorized file execution is essential to maintaining the integrity of the collected data and the surrounding network environment.