Malcolm's file‑upload component contains an almost unchanged FilePond PHP server. The upstream index.php provides a /api/fetch endpoint that accepts any URL and triggers a curl download using FOLLOWLOCATION. The server then stores the fetched response body in the upload container’s transfer directory; for HEAD requests the server returns a transfer ID that allows the caller to retrieve the file. This mechanism permits an attacker to read the contents of any URL reachable from the server, enabling internal reconnaissance, data exfiltration, or other malicious actions. The vulnerability is a classic Server‑Side Request Forgery (CWE‑918).

All releases of Malcolm that include the original FilePond PHP server, specifically any version older than v26.08.0, are vulnerable. The malfunction arises in the file‑upload component of the Malcolm application, which is managed by the CISA Malcolm vendor. Upgrades to v26.08.0 or later contain the necessary fix or hardening.

The CVSS score is 7.1, indicating a moderate to high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attacker is an authenticated or unauthenticated user with access to the Malcolm upload interface, who can exploit the fetch API to access arbitrary internal or external resources. Successful exploitation results in server‑side access to requested URLs, providing confidentiality and integrity risks but no direct remote code execution.