CVE-2026-23878

MEDIO 6.5CVE-2026-23878 · Published 19/01/2026 · updated 17/06/2026

In breve

CVE-2026-23878 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda hotcrp (hotcrp).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.31%, superiore al 23.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
hotcrp hotcrp	`= 3.1`	No fix yet

Description

HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0, authors with at least one submission on a HotCRP site could use the document API to download any documents (PDFs, attachments) associated with any submission. The problem was patched in commit ceacd5f1476458792c44c6a993670f02c984b4a0.

References

kohler/hotcrp commit aa20ef2 · Patch
kohler/hotcrp commit ceacd5f · Patch
kohler/hotcrp security advisory · Vendor Advisory

Altre vulnerabilità di hotcrp

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free