CVE-2026-13014 PUBLISHED

Remote Code Execution vulnerability in "Suspicious" application

Assigner: THA-PSIRT
Reserved: 23.06.2026 Published: 13.07.2026 Updated: 13.07.2026

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks

Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Thales CERT
Product	Suspicious
Versions	Default: unaffected affected from v1.2.0 to v1.3.4 (incl.)

Solutions

Upgrade to version v1.3.5

References

https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp

Problem Types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
CWE-73 External control of file name or path CWE
CWE-94 Improper Control of Generation of Code CWE

Impacts

Remote Code Execution
Arbitrary overwrite of writable application files
Persistent denial of service
Potential compromise of application secrets or integrations if attacker-controlled files influence configuration or code paths