Hotcrp
Monthly
HotCRP conference review software versions from October 2025 through January 2026 improperly render uploaded documents inline in the browser instead of forcing download, allowing malicious HTML or SVG files to execute JavaScript with access to user credentials and HotCRP API permissions. Attackers can exploit this stored XSS vulnerability by uploading crafted documents to submission fields, which then compromise any user who clicks the document link. A patch is available to restrict inline rendering to safe document types.
HotCRP conference review software version 3.1 has an inadequate input sanitization flaw (CVSS 9.9) that allows authenticated users to execute arbitrary code on the server through crafted submissions.
Authenticated HotCRP users can unmask the authors of anonymous reviews and comments by probing the `cmt:USER` search term, which matches papers where a visible comment was written by USER without checking whether the commenter's identity is supposed to be disclosed. The flaw was introduced with the `cmt:` search term in v2.101 (2017) and affects installations through the 3.3 fix line; exploitation requires a logged-in account with search access plus a paper whose comment is visible while the commenter's identity is hidden - the classic anonymous or double-blind review configuration - and candidate usernames must be enumerated or guessed. Impact is confidentiality-only (reviewer anonymity), no public exploit code was identified at time of analysis, and the vendor's fix commit c4b008e756650db3063e8dd8300127936aae9ec1 adds an explicit comment-identity visibility check.
HotCRP is conference review software. [CVSS 6.5 MEDIUM]
A vulnerability was found in HotCRP. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
HotCRP conference review software versions from October 2025 through January 2026 improperly render uploaded documents inline in the browser instead of forcing download, allowing malicious HTML or SVG files to execute JavaScript with access to user credentials and HotCRP API permissions. Attackers can exploit this stored XSS vulnerability by uploading crafted documents to submission fields, which then compromise any user who clicks the document link. A patch is available to restrict inline rendering to safe document types.
HotCRP conference review software version 3.1 has an inadequate input sanitization flaw (CVSS 9.9) that allows authenticated users to execute arbitrary code on the server through crafted submissions.
Authenticated HotCRP users can unmask the authors of anonymous reviews and comments by probing the `cmt:USER` search term, which matches papers where a visible comment was written by USER without checking whether the commenter's identity is supposed to be disclosed. The flaw was introduced with the `cmt:` search term in v2.101 (2017) and affects installations through the 3.3 fix line; exploitation requires a logged-in account with search access plus a paper whose comment is visible while the commenter's identity is hidden - the classic anonymous or double-blind review configuration - and candidate usernames must be enumerated or guessed. Impact is confidentiality-only (reviewer anonymity), no public exploit code was identified at time of analysis, and the vendor's fix commit c4b008e756650db3063e8dd8300127936aae9ec1 adds an explicit comment-identity visibility check.
HotCRP is conference review software. [CVSS 6.5 MEDIUM]
A vulnerability was found in HotCRP. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.