CVE-2026-78839

Description

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.

Successful exploitation of this issue requires two practical caveats. First, an attacker must either identify an existing form that has been configured to permit .phar file uploads, or possess sufficient access to edit a form's allowed extensions themselves. Second, the attacker must be able to determine the MD5 hash assigned to the uploaded file in order to retrieve and execute it, This can be either be achieved by brute-force of file names as unlimited requests can be sent in an attempt to enumerate valid filenames, or may be disclosed through secondary vulnerabilities.

Attack Vectors

If a user with form creation rights makes a form with file upload functionality where .phar format is allowed, any unauthenticated user can exploit this form to obtain Remote Code Execution. The unauthenticated user will need to bruteforce the random MD5 hash file name to retrieve the file and execute the attack.

Affected Component

Tested on Machform - version 30

Attack Type