---
id: CVE-2026-13014
title: "A vulnerability in\_Thales CERT \"Suspicious\" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\_arbitrarily overwrite writable application files—including Python modules, configuration files, c…"
summary: "A vulnerability in\_Thales CERT \"Suspicious\" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and\_arbitrarily overwrite writable application files—including Python modules, configuration files, c…"
severity: critical
cwe:
  - CWE-22
  - CWE-73
  - CWE-94
published: '2026-07-13'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13014'
references:
  - url: >-
      https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp
    label: psirt@thalesgroup.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-07-13T12:26:58.209Z'
epss: 0.00704
epssPercentile: 0.5311
vendor: Thales CERT
product: Suspicious
affected:
  - Suspicious >= v1.2.0 <= v1.3.4
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-13T14:06:22.643365Z'
cvssSource: cna
---

## Overview

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.
This vulnerability has been names "Matryoshka Mail".
Thales PSIRT 
acknowledges and thanks

Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.