CVE-2026-103541
MediumCVSS 6.3Summary
An unrestricted file upload vulnerability exists in Form Tools up to 3.1.1 in the Files::uploadFile function of global/code/actions.php (Ajax Handler component). Manipulation allows remote upload of arbitrary files. The exploit is public and may be used.
Risk Assessment
An attacker could upload malicious files (e.g., a webshell) and achieve remote code execution, leading to full system compromise. The project has not responded, increasing the risk.
Recommendation
Upgrade Form Tools beyond 3.1.1 if available, or temporarily disable the file upload feature and restrict access to actions.php. Check the server for unauthorized files.
Other vulnerabilities in Form Tools
See all- CVE-2026-103542Medium
A server-side request forgery (SSRF) vulnerability exists in Form Tools up to 3.1.1 in the smart_fill function of /global/code/actions.php (AJAX Endpoint component). Manipulation of the url argument allows server-side requests. The exploit is publicly disclosed and can be triggered remotely.
- CVE-2026-103540Medium
A vulnerability exists in Form Tools up to 3.1.1 in the Clients::updateClientSettingsTab function of global/code/Clients.class.php (Client Settings component). Manipulation of the page_titles argument leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely and the exploit is publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS