CVE-2026-13014 (GCVE-0-2026-13014)

Vulnerability from cvelistv5 – Published: 2026-07-13 09:42 – Updated: 2026-07-13 14:07
VLAI
Title
Remote Code Execution vulnerability in "Suspicious" application
Summary
A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.
Severity
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-73 - External control of file name or path
  • CWE-94 - Improper Control of Generation of Code
Assigner
References
Impacted products
Vendor Product Version
Thales CERT Suspicious Affected: v1.2.0 , ≤ v1.3.4 (git)
Create a notification for this product.
Date Public
2026-07-10 15:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13014",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T14:06:22.643365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T14:07:27.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/thalesgroup-cert/suspicious",
          "defaultStatus": "unaffected",
          "product": "Suspicious",
          "vendor": "Thales CERT",
          "versions": [
            {
              "changes": [
                {
                  "at": "patched v1.3.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "v1.3.4",
              "status": "affected",
              "version": "v1.2.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "datePublic": "2026-07-10T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability in\u0026nbsp;Thales CERT \"Suspicious\" application =\u0026lt; 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u0026nbsp;arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\u003cbr\u003eThis vulnerability has been names \"Matryoshka Mail\".\u003cbr\u003eThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
            }
          ],
          "value": "A vulnerability in\u00a0Thales CERT \"Suspicious\" application =\u003c 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u00a0arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\nThis vulnerability has been names \"Matryoshka Mail\".\nThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Remote Code Execution"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Arbitrary overwrite of writable application files"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Persistent denial of service"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Potential compromise of application secrets or integrations if attacker-controlled files influence configuration or code paths"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External control of file name or path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-13T09:42:45.431Z",
        "orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
        "shortName": "THA-PSIRT"
      },
      "references": [
        {
          "url": "https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to version v1.3.5"
            }
          ],
          "value": "Upgrade to version v1.3.5"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Remote Code Execution vulnerability in \"Suspicious\" application",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
    "assignerShortName": "THA-PSIRT",
    "cveId": "CVE-2026-13014",
    "datePublished": "2026-07-13T09:42:45.431Z",
    "dateReserved": "2026-06-23T15:40:38.489Z",
    "dateUpdated": "2026-07-13T14:07:27.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-13014",
      "date": "2026-07-16",
      "epss": "0.0047",
      "percentile": "0.37643"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-13014\",\"sourceIdentifier\":\"psirt@thalesgroup.com\",\"published\":\"2026-07-13T10:16:24.913\",\"lastModified\":\"2026-07-13T19:51:18.237\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in\u00a0Thales CERT \\\"Suspicious\\\" application =\u003c 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u00a0arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\\nThis vulnerability has been names \\\"Matryoshka Mail\\\".\\nThales PSIRT \\nacknowledges and thanks\\n\\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue.\"}],\"affected\":[{\"source\":\"psirt@thalesgroup.com\",\"affectedData\":[{\"vendor\":\"Thales CERT\",\"product\":\"Suspicious\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com/thalesgroup-cert/suspicious\",\"versions\":[{\"version\":\"v1.2.0\",\"lessThanOrEqual\":\"v1.3.4\",\"versionType\":\"git\",\"status\":\"affected\",\"changes\":[{\"at\":\"patched v1.3.5\",\"status\":\"unaffected\"}]}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@thalesgroup.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-13T14:06:22.643365Z\",\"id\":\"CVE-2026-13014\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@thalesgroup.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"},{\"lang\":\"en\",\"value\":\"CWE-73\"},{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"references\":[{\"url\":\"https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp\",\"source\":\"psirt@thalesgroup.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-13014\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-13T14:06:22.643365Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-13T14:07:14.800Z\"}}], \"cna\": {\"title\": \"Remote Code Execution vulnerability in \\\"Suspicious\\\" application\", \"source\": {\"discovery\": \"INTERNAL\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Remote Code Execution\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"value\": \"Arbitrary overwrite of writable application files\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"value\": \"Persistent denial of service\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"value\": \"Potential compromise of application secrets or integrations if attacker-controlled files influence configuration or code paths\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.2, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Thales CERT\", \"product\": \"Suspicious\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"patched v1.3.5\", \"status\": \"unaffected\"}], \"version\": \"v1.2.0\", \"versionType\": \"git\", \"lessThanOrEqual\": \"v1.3.4\"}], \"collectionURL\": \"https://github.com/thalesgroup-cert/suspicious\", \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to version v1.3.5\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Upgrade to version v1.3.5\", \"base64\": false}]}], \"datePublic\": \"2026-07-10T15:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in\\u00a0Thales CERT \\\"Suspicious\\\" application =\u003c 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\\u00a0arbitrarily overwrite writable application files\\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\\nThis vulnerability has been names \\\"Matryoshka Mail\\\".\\nThales PSIRT \\nacknowledges and thanks\\n\\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A vulnerability in\u0026nbsp;Thales CERT \\\"Suspicious\\\" application =\u0026lt; 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u0026nbsp;arbitrarily overwrite writable application files\\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\u003cbr\u003eThis vulnerability has been names \\\"Matryoshka Mail\\\".\u003cbr\u003eThales PSIRT \\nacknowledges and thanks\\n\\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-73\", \"description\": \"CWE-73 External control of file name or path\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94 Improper Control of Generation of Code\"}]}], \"providerMetadata\": {\"orgId\": \"9d5917ae-205d-4ae5-8749-1f49479b1395\", \"shortName\": \"THA-PSIRT\", \"dateUpdated\": \"2026-07-13T09:42:45.431Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-13014\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-13T14:07:27.982Z\", \"dateReserved\": \"2026-06-23T15:40:38.489Z\", \"assignerOrgId\": \"9d5917ae-205d-4ae5-8749-1f49479b1395\", \"datePublished\": \"2026-07-13T09:42:45.431Z\", \"assignerShortName\": \"THA-PSIRT\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.