Malcolm's file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: the Dockerfile copies all upstream *.php files and Malcolm overwrites only config.php and submit.php. The upstream index.php exposes a fetch API route that instructs the server to download an attacker-supplied URL and returns the response body, yielding server-side request forgery with full readback of internal services.
Server-side request forgery with full response-body readback via the unmodified FilePond fetch API route.
cve.org record · GitHub Security Advisory GHSA-cvx2-hj33-vc4q