Which versions of PHP are affected by EUVD-2026-18499?

Hytale Modding Wiki versions 1.2.0 and earlier contain a remote code execution vulnerability affecting authenticated users who can exploit a file upload bypass to execute arbitrary PHP code on the…

How to fix or mitigate EUVD-2026-18499?

Within 24 hours: Identify all systems running Hytale Modding Wiki 1.2.0 or earlier and take them offline or restrict network access to trusted IPs only; audit upload directories for suspicious .php files. Within 7 days: Contact Hytale development for patch timeline; implement Web Application Firewall (WAF) rules to block .php uploads and monitor the quickUpload() endpoint for anomalous activity. Within 30 days: Either upgrade to a patched version when available or decommission affected instances; conduct forensic analysis of upload directories and server logs for signs of exploitation dating back 90 days.

PHP EUVD-2026-18499

Q: What is the CVSS score of EUVD-2026-18499?

EUVD-2026-18499 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-34735 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-02 GitHub_M

PHP File Upload RCE

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:52 vuln.today

cvss_changed

EUVD ID Assigned

Apr 02, 2026 - 19:01 euvd

EUVD-2026-18499

Analysis Generated

Apr 02, 2026 - 19:01 vuln.today

CVE Published

Apr 02, 2026 - 18:23 nvd

HIGH 8.7

DescriptionGitHub Advisory

The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prior, the quickUpload() endpoint validates uploaded files by checking their MIME type (via PHP's finfo, which inspects file contents) but constructs the stored filename using the client-supplied file extension from getClientOriginalExtension(). These two checks are independent: an attacker can upload a file whose content passes the MIME allowlist while using a .php extension. The file is stored on the public disk and is directly accessible via URL, allowing server-side code execution. At time of publication no known patches exist.

AnalysisAI

Remote code execution in Hytale Modding Wiki version 1.2.0 and earlier allows authenticated users to upload malicious PHP files through a MIME type validation bypass. The quickUpload() endpoint performs independent validation of file content (via MIME type) and filename extension, enabling attackers to craft files with benign content signatures but executable .php extensions. Uploaded files are stored in a publicly accessible location, allowing direct URL access for server-side code execution. EPSS data unavailable; publicly available exploit code exists per SSVC assessment. No vendor-released patch identified at time of analysis.

Technical ContextAI

This vulnerability affects the Hytale Modding Wiki application (CPE 2.3:a:hytalemodding:wiki:*:*:*:*:*:*:*:*), a documentation hosting service for Hytale game modifications. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), specifically an inconsistent file validation pattern. The application uses PHP's finfo library to validate file MIME types by inspecting file headers and content, but independently constructs the stored filename using Laravel's getClientOriginalExtension() method, which trusts the client-provided filename extension. This separation allows attackers to bypass content-based validation by crafting polyglot files or files with misleading headers that pass MIME allowlist checks while retaining executable .php extensions. The files are persisted to the public disk storage, making them directly accessible via web URL without additional server configuration restrictions, enabling PHP code interpretation by the web server.

RemediationAI

No vendor-released patch identified at time of analysis per available data sources. Organizations running Hytale Modding Wiki 1.2.0 or earlier should implement immediate compensating controls: restrict file upload functionality to highly trusted administrative users only, implement server-side file extension allowlisting that rejects executable extensions (.php, .phtml, .php5, etc.) regardless of MIME type, store uploaded files outside the web root directory with access mediated through application-controlled download handlers, and configure web server rules to prevent PHP execution in upload directories (e.g., via .htaccess or nginx location blocks). Monitor the GitHub security advisory at https://github.com/HytaleModding/wiki/security/advisories/GHSA-2xqq-6778-h4j9 for patch availability. Consider implementing content security validation that ensures both MIME type and file extension are checked against a unified allowlist before accepting uploads. Organizations unable to implement adequate controls should consider disabling file upload functionality until an official patch is released.