CVE-2026-23836

CVE-2026-23836 is a critical vulnerability in HotCRP, an open-source conference review software, stemming from inadequately sanitized code generation for HotCRP formulas. Introduced in version 3.1 in April 2024, the flaw (classified under CWE-20: Improper Input Validation) enables the execution of arbitrary PHP code. It carries a CVSS v3.1 base score of 9.9, reflecting its network accessibility, low attack complexity, low required privileges, lack of user interaction, scope change, and high impacts on confidentiality, integrity, and availability.

Low-privileged users (PR:L) with network access (AV:N) can exploit this vulnerability without user interaction (UI:N). Successful exploitation allows attackers to execute arbitrary PHP code on the server, potentially leading to full system compromise, data exfiltration, modification of conference data, or further lateral movement given the scope change (S:C) and high impact ratings (C:H/I:H/A:H).

The GitHub security advisory (GHSA-hpqh-j6qx-x57h) and related commits detail the patch in HotCRP release version 3.2, which addresses the sanitization issue in formula code generation. Security practitioners should upgrade to version 3.2 or later and review access controls for formula usage in affected deployments.