CVE-2026-103541 | formtools.org Form Tools up to 3.1.1 Ajax global/code/actions.php Files::uploadFile unrestricted upload (Issue 957)

September 30, 2026 Yanac

A vulnerability categorized as critical has been discovered in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload.

This vulnerability is known as CVE-2026-103541. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More