{"affected":[{"defaultStatus":"unaffected","product":"Malcolm","source":"CNA: icscert","vendor":"CISA","versions":[{"lessThanOrEqual":"26.07.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"26.08.0"}]}],"cveId":"CVE-2026-107362","cwes":["CWE-918"],"description":"The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery (SSRF) to read HTTP, HTTPS, or FTP resources reachable from the upload container. In the default basic authentication mode this affects any authenticated user.","epss":{"date":"2026-11-04","percentile":0.28548,"score":0.00348},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/cisagov/Malcolm/security/advisories/GHSA-cvx2-hj33-vc4q"}],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: icscert","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"}],"modifiedAt":1793814711842,"publishedAt":1791480323511,"references":[{"source":"CNA: icscert","tags":[],"url":"https://github.com/cisagov/Malcolm/security/advisories/GHSA-cvx2-hj33-vc4q"},{"source":"CNA: icscert","tags":["government-resource"],"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/cisagov/Malcolm/security/advisories/GHSA-cvx2-hj33-vc4q"}],"remediation":[{"kind":"fix","source":"CNA: icscert","text":"Update to version v26.08.0"}],"revision":"b82de2cbafc92fdc1d8da2eab01ee1706654d65d73649dd098d94bf33e76f0cf","sources":[{"modifiedAt":1793814711842,"name":"CNA: icscert","retrievedAt":1793815715857,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107362"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793815818026,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107362"}],"ssvc":{"assessedAt":1791486570898,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Server-Side Request Forgery in Malcolm","updatedAt":1793815818026}