PT-2026-5496 · Hotcrp · Hotcrp

Nbars · Published 2026-01-30 · Updated 2026-02-01 · CVE-2026-25156

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HotCRP versions October 2025 through January 2026

Description HotCRP is conference review software. Versions between October 2025 and January 2026 delivered documents of all types with inline Content-Disposition, causing them to be rendered in the user’s browser instead of being downloaded. This behavior was intended only for text/plain, application/pdf, image/gif, image/jpeg, and image/png files. However, adding save=0 to the document URL could request inline delivery for any document. This made users vulnerable to cross-site scripting attacks when clicking a document link. Uploaded HTML or SVG documents could run in the viewer’s browser with access to their HotCRP credentials, allowing Javascript within those documents to make arbitrary calls to HotCRP’s API. Malicious documents could be uploaded to submission fields with “file upload” or “attachment” type, or as attachments to comments. PDF upload fields were not vulnerable. A search of documents uploaded to hotcrp.com found no evidence of exploitation. The issue was introduced in commit aa20ef288828b04550950cf67c831af8a525f508 and fixed in commit 8933e86c9f384b356dc4c6e9e2814dee1074b323.

Recommendations Update to HotCRP version 3.2.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25156

GHSA-P88P-2F2P-2476

Affected Products

Hotcrp

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25156.json · Exploit
• https://github.com/kohler/hotcrp/commit/aa20ef288828b04550950cf67c831af8a525f508 · Patch
• https://github.com/kohler/hotcrp/commit/8933e86c9f384b356dc4c6e9e2814dee1074b323 · Patch
• https://github.com/kohler/hotcrp/commit/c3d88a7e18d52119c65df31c2cc994edd2beccc5 · Patch
• https://github.com/kohler/hotcrp/security/advisories/GHSA-p88p-2f2p-2476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25156 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25156 · Vendor Advisory
• https://twitter.com/pulsepatchio/status/2017970510861087017 · Twitter Post
• https://t.me/CVEtracker/43371 · Telegram Post
• https://twitter.com/CVEnew/status/2017370554681205206 · Twitter Post