CVE-2026-107333

Summary

A URL path normalization inconsistency in Malcolm's nginx reverse proxy allows authenticated users to bypass role-based access controls by crafting specially formatted request paths. This creates a path traversal-like vulnerability where users can access administrative endpoints they shouldn't have permission to reach.

Exploitability

The exploit is moderately easy to perform as it requires only an authenticated session and knowledge of the target endpoints, with no additional prerequisites or complex payloads needed.

Blast radius

If exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive administrative interfaces including file upload, PHP server, htadmin, and authentication management systems, potentially leading to full system compromise.

Detection

Monitor nginx access logs for requests with unusual path sequences (e.g., double slashes, encoded characters) that result in successful access to restricted administrative endpoints when the user's role should have denied access.

Prioritized remediation

Upgrade to Malcolm 2.590 or later to address the URL path normalization inconsistency in the RBAC authorization layer.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.