Malcolm's file‑upload component allows any file extension to be stored, and the filename sanitizer preserves the .php extension. An authenticated user with the ROLE_UPLOAD role can then request the file over HTTP, which nginx forwards to php‑fpm, executing the code as www‑data. This flaw leads directly to arbitrary code execution on the host, affecting confidentiality, integrity, and availability of the system.

The vulnerability exists in the Malcolm network traffic analysis suite distributed by cisagov. All versions before 26.06.1, where the RBAC mode permits the ROLE_UPLOAD role to upload files, are affected. The file‑upload endpoint is POST /server/php/submit.php with uploads stored under /var/www/upload/server/php/files.

The CVSS score of 8.8 signals high severity, though the EPSS score remains under 1%, indicating a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker who can authenticate to the system with a role capable of uploading files can upload malicious PHP and later trigger its execution by accessing the file via a GET request, thereby running arbitrary code as the web server process.