CVE-2026-78839

Deferred Deferred - Pending Action

Arbitrary File Upload in AppNitro MachForm

Publication date: 2026-09-04

Last updated on: 2026-09-09

Assigner: MITRE

Description

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-09

Generated

2026-09-25

AI Q&A

2026-09-04

EPSS Evaluated

2026-09-23

NVD

CVE-2026-78839

EUVD

EUVD-2026-71712

Affected Vendors & Products

Vendor	Product	Version / Range
appnitro	machform	30

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an arbitrary file upload flaw in AppNitro MachForm v30. Attackers can exploit it by uploading a specially crafted .phar file, which allows them to execute arbitrary code on the affected system.

Detection Guidance

To detect this vulnerability, inspect uploaded files for unexpected .phar extensions or unusual file types. Check server logs for suspicious file uploads or execution attempts. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to gain control of your server or application by uploading malicious files. It may lead to data breaches, unauthorized access, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's security rules if personal or health data is compromised.

Mitigation Strategies

Immediately disable file uploads if not required. If uploads are necessary, restrict allowed file types to safe extensions and validate file contents. Update or patch the AppNitro MachForm software to a fixed version if available.

Hi! I’m here to help you understand CVE-2026-78839. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70