CVE-2026-107362 | BDVDB-2026-384758 Detail

Description#

The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery (SSRF) to read HTTP, HTTPS, or FTP resources reachable from the upload container. In the default basic authentication mode this affects any authenticated user.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-08Record published in the CVE List.
2. Version 22026-11-04Most recent update recorded in the CVE List.