CVE-2026-103541

6.3 MEDIUMpublic exploit available

Published 2026-10-01 · Updated 2026-10-01

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses

CWE-284, CWE-434

Public exploit & PoC references

https://github.com/formtools/core/issues/957
https://github.com/wawyw/cve_report/blob/main/formtools_2.md

All references

https://github.com/formtools/core/issues/957
https://github.com/wawyw/cve_report/blob/main/formtools_2.md
https://vuldb.com/cve/CVE-2026-103541
https://vuldb.com/submit/957902
https://vuldb.com/vuln/412351
https://vuldb.com/vuln/412351/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-101071PoC
MEDIUMCVE-2026-102263
MEDIUMCVE-2026-102842PoC
HIGHCVE-2026-104637PoC
MEDIUMCVE-2026-105389PoC
MEDIUMCVE-2026-108801PoC
MEDIUMCVE-2026-108922PoC
HIGHCVE-2026-108973

Related by shared AI tags and CWE weakness class. Browse the full archive.