Executive brief
Feuerhamster MailForm is a tool used to process and send web form submissions via email. A flaw in how the software handles file attachments allows an attacker to repeatedly upload files that are never deleted from the server's storage. Over time, this can fill up the server's disk space, potentially causing the website or the entire server to crash and become unavailable.
Technical details
A vulnerability exists in the attachment handling component of Feuerhamster MailForm v1.1.0. The application uses the Formidable library to parse multipart/form-data requests in 'src/router.ts', but fails to implement a cleanup routine to delete temporary files after the email-sending process in 'src/services/email.ts' completes or fails. An unauthenticated remote attacker can exploit this by repeatedly submitting forms with large attachments, leading to persistent accumulation of files in the server's temporary directory (TMPDIR). This results in a Denial of Service (DoS) via disk space exhaustion. Additionally, there is a secondary risk of information disclosure if other local users have read access to the shared temporary directory.
Affected products
- Feuerhamster MailForm 1.1.0
Timeline
- 2026-06-13: disclosed: Initial vulnerability details shared via GitHub Gist.
- 2026-06-15: advisory: CVE-2026-50878 published.