Wiki EUVD-2026-18499

Requires authenticated access to Hytale Modding Wiki v1.2.0 or earlier. Attacker must upload a file with PHP content disguised as allowed MIME type (e.g., image) but with .php extension. No victim interaction needed. Executed on public-accessible disk.

This vulnerability presents significant real-world risk despite requiring authentication (CVSS PR:L). The CVSS 4.0 score of 8.7 reflects critical impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with network-based attack vector (AV:N) and low attack complexity (AC:L). SSVC framework assessment confirms proof-of-concept exploit code exists with total technical impact, though exploitation is not automatable, requiring authenticated access and manual file crafting. The absence of CISA KEV listing indicates no confirmed active exploitation at time of analysis. However, the combination of public POC availability, straightforward exploitation mechanics, and direct RCE capability makes this a genuine priority for organizations running affected versions. The primary risk mitigation is that exploitation requires valid authenticated credentials (PR:L), reducing exposure compared to unauthenticated RCE vulnerabilities. No vendor-released patch identified at time of analysis significantly elevates operational risk, as defenders lack a complete remediation path beyond compensating controls.

An authenticated attacker with low-privilege wiki contributor access logs into the Hytale Modding Wiki platform and navigates to a module utilizing the quickUpload() functionality. The attacker crafts a malicious file containing PHP webshell code but manipulates the file header bytes to produce a MIME type matching the application's allowlist (e.g., image/png or text/plain). The attacker names this file with a .php extension and uploads it through the web interface. The server's finfo-based MIME validation approves the file content while getClientOriginalExtension() preserves the .php extension in the stored filename. The file is written to the public disk storage directory, and the attacker retrieves the predictable or disclosed file URL. Accessing this URL directly through a web browser causes the web server to interpret and execute the embedded PHP code, granting the attacker remote command execution capabilities on the underlying server with web server process privileges, enabling data exfiltration, lateral movement, or full system compromise.