CVE-2026-107362

Malcolm’s file-upload component includes the upstream FilePond PHP server (pqina/filepond-server-php) largely unchanged: the image copies all upstream PHP files and Malcolm only replaces config.php and submit.php. Upstream index.php exposes a fetch route that makes the server download an arbitrary URL with curl, following redirects, and on HEAD requests writes the response body into the upload container’s transfer directory and returns the transfer ID, so the caller can read the fetched content back. An authenticated attacker (low privileges) can therefore use the service as a server-side request forgery with full response readback, exposing internal or otherwise unreachable resources (high confidentiality impact, limited availability impact). Deployments that run this Malcolm file-upload component are affected; no affected version range is stated in the advisory. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known.

What to do: Treat the Malcolm file-upload service as able to fetch and return arbitrary URLs until it is patched. Restrict it to trusted users and networks, block outbound access from the upload container except to required destinations, and remove or disable the upstream FilePond fetch route (do not leave unmodified upstream index.php in place). Upgrade to a Malcolm release that replaces or hardens this component once the vendor publishes one; no fixed version is identified in the advisory data.