# CVE-2026-103541: Form Tools arbitrary PHP upload in smart_fill handler

Source: https://junglewise.ai/threats/cve-2026-103541-a-vulnerability-was-detected-in-formtools-org-form-tools-up-to-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103541 · Severity: medium · CVSS 6.3 · Published 2026-10-01

Form Tools is a web form creation and submission platform. The smart_fill feature allows any authenticated user, including low-privileged clients, to upload PHP files to a web-accessible directory without validation, enabling remote code execution with web server privileges. An attacker with a valid user account can upload and execute a PHP web shell to compromise the server.

Technologies: [Formtools.Org Form Tools](https://junglewise.ai/threats/technologies/form-tools). Vendors: [Formtools.Org](https://junglewise.ai/threats/vendors/formtools-org).

## Quick answers

**Is CVE-2026-103541 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103541 being exploited in the wild.

**How severe is CVE-2026-103541?** Medium severity, with a CVSS score of 6.3, published 1 October 2026.

**Which products and versions are affected?** Formtools.Org Form Tools up to 3.1.1.

**Is there a fix for CVE-2026-103541?** No fixed version is recorded yet. Disable PHP script execution in the upload directory via web server configuration (.htaccess or nginx rules); store uploaded files outside the web root; restrict smart_fill uploads to administrators only. These can be applied pending a product update. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103541 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-103541?** Check whether you run Formtools.Org Form Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable PHP script execution in the upload directory via web server configuration (.htaccess or nginx rules); store uploaded files outside the web root; restrict smart_fill uploads to administrators only. These can be applied pending a product update.

## Technical details

The vulnerability exists in the Ajax handler (global/code/actions.php) which processes smart_fill upload requests via the upload_scraped_page_for_smart_fill action. The Files::uploadFile() function in Files.class.php performs no extension, MIME type, or content validation before moving uploaded files to the web-accessible upload directory with chmod 0777. Any authenticated user satisfying checkAuth('user', false) can exploit this, and the endpoint lacks CSRF protection, allowing cross-site request forgery from authenticated victims.

## Affected products

- formtools.org Form Tools up to 3.1.1

## Timeline

- 2026-09-03: disclosed
- 2026-10-01: advisory

## References

- [https://github.com/formtools/core/issues/957](https://github.com/formtools/core/issues/957)
- [https://github.com/wawyw/cve_report/blob/main/formtools_2.md](https://github.com/wawyw/cve_report/blob/main/formtools_2.md)

## Related threats

- [Form Tools smart_fill endpoint server-side request forgery](https://junglewise.ai/threats/cve-2026-103542-a-flaw-has-been-found-in-formtools-org-form-tools-up-to-3-1-1)
- [Form Tools Smarty template injection in client settings](https://junglewise.ai/threats/cve-2026-103540-a-security-vulnerability-has-been-detected-in-formtools-org-form)