PT-2026-3476 · Hotcrp · Hotcrp

Cyanpencil · Published 2026-01-19 · Updated 2026-01-21 · CVE-2026-23836

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HotCRP version 3.1

Description HotCRP is conference review software. A flaw introduced in April 2024 in version 3.1 allows users to trigger the execution of arbitrary PHP code due to inadequately sanitized code generation for HotCRP formulas. The issue grants remote code execution with user privileges.

Recommendations Update HotCRP to version 3.2.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-23836

GHSA-HPQH-J6QX-X57H

Affected Products

Hotcrp

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23836.json · Exploit
• https://github.com/kohler/hotcrp/commit/bfc7e0db15df6ed6d544a639020d2ce05a5f0834 · Patch
• https://github.com/kohler/hotcrp/commit/4674fcfbb76511072a1145dad620756fc1d4b4e9 · Patch
• https://github.com/kohler/hotcrp/security/advisories/GHSA-hpqh-j6qx-x57h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23836 · Security Note
• https://twitter.com/0dayPublishing/status/2013313295399195029 · Twitter Post
• https://twitter.com/TheHackerWire/status/2013325533719810288 · Twitter Post
• https://twitter.com/CVEnew/status/2013316905440780440 · Twitter Post
• https://twitter.com/pulsepatchio/status/2013984595952439381 · Twitter Post
• https://twitter.com/CveFindCom/status/2013320340206649777 · Twitter Post