Vulnerability · Published Jan 19, 2026 · Assigned by GitHub_M

CVE-2026-23878HotCRP vulnerable to exposure of submitted documents

Medium 6.5

In plain English

A medium-severity security flaw in hotcrp from kohler. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 76.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0, authors with at least one submission on a HotCRP site could use the document API to download any documents (PDFs, attachments) associated with any submission. The problem was patched in commit ceacd5f1476458792c44c6a993670f02c984b4a0.

Affected products (as reported)

Vendor	Product	Versions
kohler	hotcrp	>= aa20ef288828b04550950cf67c831af8a525f508, < ceacd5f1476458792c44c6a993670f02c984b4a0

Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/kohler/hotcrp/security/advisories/GHSA-vh3x-xwj4-jvqx x_refsource_CONFIRM
https://github.com/kohler/hotcrp/commit/aa20ef288828b04550950cf67c831af8a525f508 x_refsource_MISC
https://github.com/kohler/hotcrp/commit/ceacd5f1476458792c44c6a993670f02c984b4a0 x_refsource_MISC