CVE-2026-23836
HotCRP vulnerable to remote code execution through formulas
Résumé
HotCRP vulnerable to remote code execution through formulas
Description d'origine
La description telle que publiée par la source (souvent en anglais).
HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release version 3.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com