Remote Code Execution vulnerability in "Suspicious" application

published 2026-07-13 3mo ago modified 2026-10-24 16d ago also EUVD-2026-43336

cvss: 9.2; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits: 0; none known

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks

Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.

Is CVE-2026-13014 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 3mo ago (2026-07-13)

Exploit prediction

0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Thales CERT Suspicious

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-73 External Control of File Name or Path
CWE-94 Improper Control of Generation of Code

References

github.com /thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp

Sources

CVE List CVE-2026-13014
NVD CVE-2026-13014

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.