Executive brief
The Hytale Modding Wiki, a platform for hosting mod documentation, contains a security flaw in its file upload system. An attacker with basic editing permissions can bypass security checks to upload and execute malicious scripts on the server. This could lead to a total system takeover, including the theft of sensitive database information, application secrets, and user data.
Technical details
A remote code execution (RCE) vulnerability exists in the `quickUpload()` endpoint of the Hytale Modding Wiki due to inconsistent file validation. While the application uses PHP's `finfo` to verify the MIME type of uploaded content, it relies on the client-provided `getClientOriginalExtension()` to determine the final file extension. An authenticated attacker with edit permissions can craft a file containing valid image headers (e.g., GIF89a) followed by PHP code and assign it a `.php` extension. Because the file is stored in a publicly accessible directory and the web server is not configured to block script execution in that path, the attacker can execute arbitrary code by visiting the file's URL. This can be used to read `.env` files, exfiltrate the database, or establish a persistent web shell.
Affected products
- HytaleModding wiki <= 1.2.0
Timeline
- 2026-03-30: disclosed: Vulnerability discovered and reported by LiamSystems
- 2026-04-02: advisory: Initial CVE publication