CVE-2026-103541

EUVD-2026-90499
A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
formtoolsform_tools
3.1.0
CNA
formtoolsform_tools
3.1.1
CNA
Common Weakness Enumeration
References
https://github.com/formtools/core/issues/957
https://github.com/wawyw/cve_report/blob/main/formtools_2.md
https://vuldb.com/cve/CVE-2026-103541
https://vuldb.com/submit/957902
https://vuldb.com/vuln/412351
https://vuldb.com/vuln/412351/cti