CVE-2026-23836 — HotCRP vulnerable to remote code execution through formulas
HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to …
Published: 2026-01-19 · CVSS: 10.0 · CVSS 3.1
HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release version 3.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7