CVE-2026-13014CWE-22CWE-73CWE-94

Remote Code Execution vulnerability in "Suspicious" application

Critical · published July 13, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
52.8
In the wild
Unconfirmed
What it is

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.

This vulnerability has been names "Matryoshka Mail".

Thales PSIRT

acknowledges and thanks

Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00704 · 52.8th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-13T09:42Z
EPSS history
Timeline
  • 13 JUL 09:42Z
    Remote Code Execution vulnerability in "Suspicious" application
    cvelistv5