Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-34735Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`
High 8.7
In plain English
A high-severity unrestricted file upload in wiki from HytaleModding. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prior, the quickUpload() endpoint validates uploaded files by checking their MIME type (via PHP's finfo, which inspects file contents) but constructs the stored filename using the client-supplied file extension from getClientOriginalExtension(). These two checks are independent: an attacker can upload a file whose content passes the MIME allowlist while using a .php extension. The file is stored on the public disk and is directly accessible via URL, allowing server-side code execution. At time of publication no known patches exist.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HytaleModding | wiki | <= 1.2.0 |
Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/HytaleModding/wiki/security/advisories/GHSA-2xqq-6778-h4j9 x_refsource_CONFIRM