Description

Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-31T21:17:52.027Z",
  "pubdate": "2026-08-31T21:17:52.027Z",
  "executiveSummary": "Hash Form versions 1.4.2 and below contain an unauthenticated arbitrary file upload vulnerability. This security flaw allows remote, unauthenticated attackers to bypass intended validation mechanisms to upload arbitrary files to the underlying web server.\nThe vulnerability type is categorized as an unrestricted upload of a file with a dangerous type. Successful exploitation enables attackers to achieve Remote Code Execution (RCE) by uploading malicious scripts, such as web shells, into accessible directories.\nThe impact is critical, as it compromises the integrity, confidentiality, and availability of the affected system. Once a malicious file is successfully uploaded and executed, the attacker can gain full control over the application environment, potentially leading to unauthorized data access, system manipulation, or further lateral movement within the network.\nExploitation does not require prior authentication, significantly lowering the barrier for entry. Organizations utilizing the affected versions are at high risk of exploitation from external threat actors.",
  "technicalDetails": "The vulnerability resides within the file upload handling logic of the Hash Form plugin. The application fails to adequately sanitize or restrict the types of files accepted during the form submission process, allowing an attacker to supply malicious payloads disguised as legitimate attachments.\nThe root cause is a lack of server-side validation regarding the file extension, MIME type, and content inspection. Because the application does not enforce strict allow-listing of permitted file formats, it facilitates the upload of executable scripts (e.g., .php, .phtml, .php5) that the web server subsequently processes.\nThe attack flow begins with the attacker identifying the target endpoint used by Hash Form to receive form submissions. The attacker then crafts a multipart/form-data request containing a malicious payload. By sending this request to the vulnerable endpoint without authentication, the attacker forces the application to write the malicious file to the filesystem, typically within the web-accessible directory structure.\nAfter the file is stored, the attacker can invoke the script via a standard HTTP GET request. The web server then executes the code within the context of the web server process (e.g., www-data). This interaction allows the attacker to execute arbitrary system commands, manipulate application data, or deploy persistent backdoors.\nThe vulnerability is present in Hash Form versions <= 1.4.2. Exploitation is facilitated by the plugin's direct handling of user-supplied input without verifying the integrity of the uploaded file's metadata or contents. No special privileges are required, and the attack can be executed over the network from any remote host capable of reaching the web application's submission endpoint.\nPost-exploitation impact typically involves full system compromise. An attacker may leverage the execution context to escalate privileges, dump configuration files, exfiltrate sensitive database contents, or use the compromised server as a pivot point for attacking other internal network assets."
}