CVE-2026-19671

MediumCVSS 6.5/10Last modified Sep 8, 2026

Description

Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-409

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 18, 2026
Last modified: Sep 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-196726.3The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destina CVE-2026-196737.1ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct CVE-2026-196767.8The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device CVE-2026-196779.3An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote atta CVE-2026-196788.7A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthe CVE-2026-196798.8An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames co CVE-2026-196807.1A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's data CVE-2026-196819.9An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this CVE-2026-196829.9A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arb CVE-2026-196837.4A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS servi CVE-2026-196857.1NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. T CVE-2026-19695.3The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated use