CVE-2026-78839
Received Received - Intake

Arbitrary File Upload in AppNitro MachForm

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: MITRE

Description
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-78839
EUVD
EUVD-2026-71712

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
appnitro machform 30

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an arbitrary file upload flaw in AppNitro MachForm v30. Attackers can exploit it by uploading a specially crafted .phar file, which allows them to execute arbitrary code on the affected system.

Detection Guidance

To detect this vulnerability, inspect uploaded files for unexpected .phar extensions or unusual file types. Check server logs for suspicious file uploads or execution attempts. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to gain control of your server or application by uploading malicious files. It may lead to data breaches, unauthorized access, or further compromise of your system.

Mitigation Strategies

Immediately disable file uploads if not required. If uploads are necessary, restrict allowed file types to safe extensions and validate file contents. Update or patch the AppNitro MachForm software to a fixed version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart