File Upload Vulnerability in Malcolm Affecting FilePond PHP Server Component

CVE-2026-107362

What is CVE-2026-107362?

The Malcolm file-upload component includes a largely unmodified upstream FilePond PHP server, exposing a critical vulnerability. This occurs due to the way the index.php file provides a fetch API route, allowing the server to download content from arbitrary URLs using curl. This capability, coupled with the FOLLOWLOCATION option, could lead to potential exploitation. Specifically, HEAD requests can retrieve an arbitrary response and save it in the upload container's transfer directory, giving attackers the ability to access sensitive data from the fetched content. Proper mitigation measures should be implemented immediately to safeguard against such risks.

References