CVE-2026-13014
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability in Thales CERT "Suspicious" application version 1.3.4 and earlier allows a remote, unauthenticated attacker to execute arbitrary code and overwrite writable application files, including Python modules, configuration files, cron inputs, and runtime artifacts. This leads to persistent denial of service, potential compromise of application secrets or integrations, and root-level execution inside the Django application container.
Risk Assessment
The organization faces complete compromise of the application container, persistent service disruption, and leakage of sensitive data, potentially resulting in severe security breaches and loss of trust.
Recommendation
Immediately update Thales CERT "Suspicious" application to a version later than 1.3.4. If an update is unavailable, restrict access to trusted networks and implement file integrity monitoring mechanisms.
Original NVD description (English source)
A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.