Search
Find a vulnerability
Search criteria
2 vulnerabilities by Thales CERT
CVE-2026-13014 (GCVE-0-2026-13014)
Vulnerability from nvd – Published: 2026-07-13 09:42 – Updated: 2026-07-13 14:07
VLAI
EPSS
VEX
Title
Remote Code Execution vulnerability in "Suspicious" application
Summary
A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.
This vulnerability has been names "Matryoshka Mail".
Thales PSIRT
acknowledges and thanks
Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales CERT | Suspicious |
Affected:
v1.2.0 , ≤ v1.3.4
(git)
|
Date Public
2026-07-10 15:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13014",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T14:06:22.643365Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T14:07:27.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/thalesgroup-cert/suspicious",
"defaultStatus": "unaffected",
"product": "Suspicious",
"vendor": "Thales CERT",
"versions": [
{
"changes": [
{
"at": "patched v1.3.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "v1.3.4",
"status": "affected",
"version": "v1.2.0",
"versionType": "git"
}
]
}
],
"datePublic": "2026-07-10T15:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in\u0026nbsp;Thales CERT \"Suspicious\" application =\u0026lt; 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u0026nbsp;arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\u003cbr\u003eThis vulnerability has been names \"Matryoshka Mail\".\u003cbr\u003eThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
}
],
"value": "A vulnerability in\u00a0Thales CERT \"Suspicious\" application =\u003c 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u00a0arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\nThis vulnerability has been names \"Matryoshka Mail\".\nThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution"
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Arbitrary overwrite of writable application files"
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Persistent denial of service"
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Potential compromise of application secrets or integrations if attacker-controlled files influence configuration or code paths"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External control of file name or path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T09:42:45.431Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to version v1.3.5"
}
],
"value": "Upgrade to version v1.3.5"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Remote Code Execution vulnerability in \"Suspicious\" application",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-13014",
"datePublished": "2026-07-13T09:42:45.431Z",
"dateReserved": "2026-06-23T15:40:38.489Z",
"dateUpdated": "2026-07-13T14:07:27.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13014 (GCVE-0-2026-13014)
Vulnerability from cvelistv5 – Published: 2026-07-13 09:42 – Updated: 2026-07-13 14:07
VLAI
EPSS
VEX
Title
Remote Code Execution vulnerability in "Suspicious" application
Summary
A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.
This vulnerability has been names "Matryoshka Mail".
Thales PSIRT
acknowledges and thanks
Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales CERT | Suspicious |
Affected:
v1.2.0 , ≤ v1.3.4
(git)
|
Date Public
2026-07-10 15:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13014",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T14:06:22.643365Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T14:07:27.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/thalesgroup-cert/suspicious",
"defaultStatus": "unaffected",
"product": "Suspicious",
"vendor": "Thales CERT",
"versions": [
{
"changes": [
{
"at": "patched v1.3.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "v1.3.4",
"status": "affected",
"version": "v1.2.0",
"versionType": "git"
}
]
}
],
"datePublic": "2026-07-10T15:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in\u0026nbsp;Thales CERT \"Suspicious\" application =\u0026lt; 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u0026nbsp;arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\u003cbr\u003eThis vulnerability has been names \"Matryoshka Mail\".\u003cbr\u003eThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
}
],
"value": "A vulnerability in\u00a0Thales CERT \"Suspicious\" application =\u003c 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\u00a0arbitrarily overwrite writable application files\u2014including Python modules, configuration files, cron inputs, and runtime artifacts\u2014leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\nThis vulnerability has been names \"Matryoshka Mail\".\nThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution"
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Arbitrary overwrite of writable application files"
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Persistent denial of service"
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Potential compromise of application secrets or integrations if attacker-controlled files influence configuration or code paths"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External control of file name or path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T09:42:45.431Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to version v1.3.5"
}
],
"value": "Upgrade to version v1.3.5"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Remote Code Execution vulnerability in \"Suspicious\" application",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-13014",
"datePublished": "2026-07-13T09:42:45.431Z",
"dateReserved": "2026-06-23T15:40:38.489Z",
"dateUpdated": "2026-07-13T14:07:27.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}