CVE-2026-13014

Remote Code Execution vulnerability in "Suspicious" application

State: Published
Severity: 9.2 Critical
Published: Jul 13, 2026
Updated: Oct 1, 2026
Reserved: Jun 23, 2026

Description

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks

Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	THA-PSIRT

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 External control of file name or path
CWE-94 Improper Control of Generation of Code

Affected Products

Product	Versions
SuspiciousThales CERT	v1.2.0 through v1.3.4Affectedfrom patched v1.3.5Not affected

References

https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.