CVE-2026-78839

MachForm v30, a self-hosted PHP form builder sold by AppNitro, contains an unrestricted file upload flaw (CWE-434) that accepts files of dangerous types, including crafted .phar archives. The CVSS vector indicates the attack is carried out over the network by an unauthenticated attacker with no user interaction required, though the high complexity value suggests specific server-side conditions must be met for the uploaded file to be executed. If those conditions are met, the attacker gains arbitrary code execution on the web server under the web application's account, with high impact to confidentiality, integrity, and availability. Any organization running a MachForm v30 deployment, especially one reachable from the internet, is affected; no affected or fixed version range beyond v30 has been published. Exploitation has not been confirmed in the wild: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns roughly a 0.3% probability of exploitation within 30 days.

What to do: Update MachForm via AppNitro's official channels — no fixed version number has been published, so confirm the patched release with the vendor before relying on it. Until patched, restrict allowed upload types (block .phar and related PHP-executable extensions), serve uploaded files from non-executable paths, and consider WAF filtering on upload endpoints. Review MachForm upload directories and web logs for unexpected .phar or PHP files that could indicate prior exploitation.