Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by Thales CERT

    CVE-2026-13014 (GCVE-0-2026-13014)

    Vulnerability from nvd – Published: 2026-07-13 09:42 – Updated: 2026-07-13 14:07
    VLAI
    Title
    Remote Code Execution vulnerability in "Suspicious" application
    Summary
    A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.
    Severity
    9.2 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    • CWE-73 - External control of file name or path
    • CWE-94 - Improper Control of Generation of Code
    Assigner
    References
    Impacted products
    Vendor Product Version
    Thales CERT Suspicious Affected: v1.2.0 , ≤ v1.3.4 (git)
    		Create a notification for this product.
    Date Public
    2026-07-10 15:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13014",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T14:06:22.643365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T14:07:27.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/thalesgroup-cert/suspicious",
          "defaultStatus": "unaffected",
          "product": "Suspicious",
          "vendor": "Thales CERT",
          "versions": [
            {
              "changes": [
                {
                  "at": "patched v1.3.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "v1.3.4",
              "status": "affected",
              "version": "v1.2.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "datePublic": "2026-07-10T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability in\u0026nbsp;Thales CERT \"Suspicious\" application =\u0026lt; 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u0026nbsp;arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\u003cbr\u003eThis vulnerability has been names \"Matryoshka Mail\".\u003cbr\u003eThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
            }
          ],
          "value": "A vulnerability in\u00a0Thales CERT \"Suspicious\" application =\u003c 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u00a0arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\nThis vulnerability has been names \"Matryoshka Mail\".\nThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Remote Code Execution"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Arbitrary overwrite of writable application files"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Persistent denial of service"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Potential compromise of application secrets or integrations if attacker-controlled files influence configuration or code paths"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External control of file name or path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-13T09:42:45.431Z",
        "orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
        "shortName": "THA-PSIRT"
      },
      "references": [
        {
          "url": "https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to version v1.3.5"
            }
          ],
          "value": "Upgrade to version v1.3.5"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Remote Code Execution vulnerability in \"Suspicious\" application",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
    "assignerShortName": "THA-PSIRT",
    "cveId": "CVE-2026-13014",
    "datePublished": "2026-07-13T09:42:45.431Z",
    "dateReserved": "2026-06-23T15:40:38.489Z",
    "dateUpdated": "2026-07-13T14:07:27.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-13014 (GCVE-0-2026-13014)

    Vulnerability from cvelistv5 – Published: 2026-07-13 09:42 – Updated: 2026-07-13 14:07
    VLAI
    Title
    Remote Code Execution vulnerability in "Suspicious" application
    Summary
    A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.
    Severity
    9.2 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    • CWE-73 - External control of file name or path
    • CWE-94 - Improper Control of Generation of Code
    Assigner
    References
    Impacted products
    Vendor Product Version
    Thales CERT Suspicious Affected: v1.2.0 , ≤ v1.3.4 (git)
    		Create a notification for this product.
    Date Public
    2026-07-10 15:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13014",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T14:06:22.643365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T14:07:27.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/thalesgroup-cert/suspicious",
          "defaultStatus": "unaffected",
          "product": "Suspicious",
          "vendor": "Thales CERT",
          "versions": [
            {
              "changes": [
                {
                  "at": "patched v1.3.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "v1.3.4",
              "status": "affected",
              "version": "v1.2.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "datePublic": "2026-07-10T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability in\u0026nbsp;Thales CERT \"Suspicious\" application =\u0026lt; 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u0026nbsp;arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\u003cbr\u003eThis vulnerability has been names \"Matryoshka Mail\".\u003cbr\u003eThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
            }
          ],
          "value": "A vulnerability in\u00a0Thales CERT \"Suspicious\" application =\u003c 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u00a0arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\nThis vulnerability has been names \"Matryoshka Mail\".\nThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Remote Code Execution"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Arbitrary overwrite of writable application files"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Persistent denial of service"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Potential compromise of application secrets or integrations if attacker-controlled files influence configuration or code paths"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External control of file name or path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-13T09:42:45.431Z",
        "orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
        "shortName": "THA-PSIRT"
      },
      "references": [
        {
          "url": "https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to version v1.3.5"
            }
          ],
          "value": "Upgrade to version v1.3.5"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Remote Code Execution vulnerability in \"Suspicious\" application",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
    "assignerShortName": "THA-PSIRT",
    "cveId": "CVE-2026-13014",
    "datePublished": "2026-07-13T09:42:45.431Z",
    "dateReserved": "2026-06-23T15:40:38.489Z",
    "dateUpdated": "2026-07-13T14:07:27.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}