CVE-2026-81780
CriticalCVSS 10.0Summary
An unauthenticated Arbitrary File Upload vulnerability was detected in Hash Form versions up to 1.4.2. This vulnerability may allow an attacker to upload malicious files to the server.
Risk Assessment
An attacker can upload malicious files such as webshells, potentially leading to full server compromise and data theft.
Recommendation
Update Hash Form to the latest patched version. Additionally, implement file type validation and restrict upload directory permissions.
Other vulnerabilities in Hash Form
See all- CVE-2026-78280Medium
Unauthenticated CSRF vulnerability in Hash Form versions up to 1.4.0. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.
- CVE-2026-78292Critical
The Hash Form plugin versions up to 1.4.1 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.
Original NVD description (English source)
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.