EUVD-2026-71712
GHSA-5w46-w28q-f95g
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible unauthenticated upload, but AC:H because .phar execution requires non-default server handler configuration; full RCE impact on successful exploitation.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.
AnalysisAI
Unrestricted file upload in AppNitro MachForm v30 permits unauthenticated remote attackers to achieve code execution by uploading a crafted .phar (PHP Archive) file through the application's file upload functionality. Because the application fails to block .phar extensions alongside conventional dangerous types like .php, an attacker can cause the PHP runtime to execute attacker-supplied code upon accessing the uploaded file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target server must be configured to execute .phar files through the PHP interpreter - this requires either an explicit handler mapping for .phar in the web server configuration (e.g., Apache AddHandler or nginx fastcgi_pass for .phar) or a permissive catch-all PHP handler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact but assigns high attack complexity, acknowledging that successful exploitation requires the target server to execute .phar files - a non-default configuration on many hosts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been confirmed from the available references at time of analysis - no AppNitro security advisory or fixed version number appears in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running MachForm v30 and disable file upload functionality or restrict uploads to non-executable file types; implement network-level blocking of .phar and PHP-executable file uploads via Web Application Firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today