CVE-2026-103541: formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload
A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a low-privileged account, as reflected by the PR:L attack-vector metric. The attack can be performed remotely and does not require user interaction.
Are deployments running the affected releases exposed by default?
The available data identifies Form Tools versions up to 3.1.1 as affected, but it does not state whether the vulnerable Ajax upload functionality is enabled or reachable in a default installation.
How urgent is remediation?
The issue is rated medium severity with a CVSS score of 6.3, but a public exploit is available and the report states that no vendor response has been received. Prioritize affected internet-accessible deployments and review access to the Ajax upload handler.
Is a fix or workaround documented?
No fix, patched version, or vendor-supported workaround is provided in the available data. If patching cannot proceed, restrict access to the affected Ajax handler and limit low-privileged accounts where operationally possible.