Executive brief
MachForm is a web-based form builder that allows organizations to create custom online forms. A flaw in the file upload functionality enables attackers to upload and execute malicious code files (specifically .phar files), potentially compromising the server and gaining full control over the application and any data it processes. Exploitation requires either a form configured to accept .phar uploads or administrative access to modify form settings.
Technical details
The vulnerability is an arbitrary file upload flaw in MachForm v30's upload.php endpoint that allows .phar files to be uploaded when explicitly configured as permitted file types. The uploaded files are assigned MD5-based filenames and stored on the web-accessible server. An attacker can retrieve and execute the uploaded .phar file either by brute-forcing the random MD5 hash filename (unlimited requests are permitted) or by leveraging secondary vulnerabilities that disclose the filename. Exploitation requires either a form pre-configured to accept .phar uploads, or sufficient access rights to modify form upload settings. The attack results in remote code execution with server privileges.
Affected products
- AppNitro MachForm v30
Timeline
- 2026-09-04: disclosed