CVE-2026-103541: formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-284

Description

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

formtools.org Form Tools: 3.1.0, 3.1.1

References

https://github.com/formtools/core/issues/957
https://github.com/wawyw/cve_report/blob/main/formtools_2.md
https://vuldb.com/cve/CVE-2026-103541
https://vuldb.com/submit/957902
https://vuldb.com/vuln/412351
https://vuldb.com/vuln/412351/cti

Get alerted when CVE-2026-103541 or the next vulnerability affects your stack