{"id":"CVE-2026-78839","title":"An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.","summary":"An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434"],"published":"2026-09-04","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:20:42.553","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78839","references":[{"url":"https://github.com/nabeelmkhan/CVE-2026-78839","label":"cve@mitre.org"},{"url":"https://packetstormsecurity.com","label":"cve@mitre.org"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00553,"epssPercentile":0.43728,"exploits":{"github":1,"githubRepos":["https://github.com/nabeelmkhan/CVE-2026-78839"],"checkedAt":"2026-09-25T08:21:14.631Z"},"exploitAvailable":true,"ingestedAt":"2026-09-08T20:10:03.168Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T19:34:29.150877Z"},"slug":"CVE-2026-78839","body":"## Overview\n\nAn arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201950,"id":"CVE-2026-78839","ts":1789399993212,"field":"cvss","old":null,"new":"8.1"},{"seq":201949,"id":"CVE-2026-78839","ts":1789399993212,"field":"severity","old":"none","new":"high"},{"seq":200680,"id":"CVE-2026-78839","ts":1789397585350,"field":"cvss","old":"8.1","new":null},{"seq":200679,"id":"CVE-2026-78839","ts":1789397585350,"field":"severity","old":"high","new":"none"},{"seq":199387,"id":"CVE-2026-78839","ts":1789395475387,"field":"cvss","old":null,"new":"8.1"},{"seq":199386,"id":"CVE-2026-78839","ts":1789395475387,"field":"severity","old":"none","new":"high"},{"seq":198632,"id":"CVE-2026-78839","ts":1789392188080,"field":"cvss","old":"8.1","new":null},{"seq":198631,"id":"CVE-2026-78839","ts":1789392188080,"field":"severity","old":"high","new":"none"},{"seq":196963,"id":"CVE-2026-78839","ts":1789384273016,"field":"cvss","old":null,"new":"8.1"},{"seq":196962,"id":"CVE-2026-78839","ts":1789384273016,"field":"severity","old":"none","new":"high"},{"seq":194094,"id":"CVE-2026-78839","ts":1789378693728,"field":"cvss","old":"8.1","new":null},{"seq":194093,"id":"CVE-2026-78839","ts":1789378693728,"field":"severity","old":"high","new":"none"},{"seq":192881,"id":"CVE-2026-78839","ts":1789376494302,"field":"cvss","old":null,"new":"8.1"},{"seq":192880,"id":"CVE-2026-78839","ts":1789376494302,"field":"severity","old":"none","new":"high"},{"seq":191668,"id":"CVE-2026-78839","ts":1789373590268,"field":"cvss","old":"8.1","new":null},{"seq":191667,"id":"CVE-2026-78839","ts":1789373590268,"field":"severity","old":"high","new":"none"},{"seq":190453,"id":"CVE-2026-78839","ts":1789369449367,"field":"cvss","old":null,"new":"8.1"},{"seq":190452,"id":"CVE-2026-78839","ts":1789369449367,"field":"severity","old":"none","new":"high"},{"seq":189240,"id":"CVE-2026-78839","ts":1789368373300,"field":"cvss","old":"8.1","new":null},{"seq":189239,"id":"CVE-2026-78839","ts":1789368373300,"field":"severity","old":"high","new":"none"},{"seq":188023,"id":"CVE-2026-78839","ts":1789365211371,"field":"cvss","old":null,"new":"8.1"},{"seq":188022,"id":"CVE-2026-78839","ts":1789365211371,"field":"severity","old":"none","new":"high"},{"seq":186810,"id":"CVE-2026-78839","ts":1789363454839,"field":"cvss","old":"8.1","new":null},{"seq":186809,"id":"CVE-2026-78839","ts":1789363454839,"field":"severity","old":"high","new":"none"},{"seq":185596,"id":"CVE-2026-78839","ts":1789361195097,"field":"cvss","old":null,"new":"8.1"},{"seq":185595,"id":"CVE-2026-78839","ts":1789361195097,"field":"severity","old":"none","new":"high"},{"seq":184383,"id":"CVE-2026-78839","ts":1789358318824,"field":"cvss","old":"8.1","new":null},{"seq":184382,"id":"CVE-2026-78839","ts":1789358318824,"field":"severity","old":"high","new":"none"},{"seq":182634,"id":"CVE-2026-78839","ts":1789354302441,"field":"cvss","old":null,"new":"8.1"},{"seq":182633,"id":"CVE-2026-78839","ts":1789354302441,"field":"severity","old":"none","new":"high"},{"seq":181427,"id":"CVE-2026-78839","ts":1789353279957,"field":"cvss","old":"8.1","new":null},{"seq":181426,"id":"CVE-2026-78839","ts":1789353279957,"field":"severity","old":"high","new":"none"},{"seq":180220,"id":"CVE-2026-78839","ts":1789350265248,"field":"cvss","old":null,"new":"8.1"},{"seq":180219,"id":"CVE-2026-78839","ts":1789350265248,"field":"severity","old":"none","new":"high"},{"seq":179013,"id":"CVE-2026-78839","ts":1789348256911,"field":"cvss","old":"8.1","new":null},{"seq":179012,"id":"CVE-2026-78839","ts":1789348256911,"field":"severity","old":"high","new":"none"},{"seq":177806,"id":"CVE-2026-78839","ts":1789346355765,"field":"cvss","old":null,"new":"8.1"},{"seq":177805,"id":"CVE-2026-78839","ts":1789346355765,"field":"severity","old":"none","new":"high"},{"seq":176599,"id":"CVE-2026-78839","ts":1789343156674,"field":"cvss","old":"8.1","new":null},{"seq":176598,"id":"CVE-2026-78839","ts":1789343156674,"field":"severity","old":"high","new":"none"},{"seq":174716,"id":"CVE-2026-78839","ts":1789334852922,"field":"cvss","old":null,"new":"8.1"},{"seq":174715,"id":"CVE-2026-78839","ts":1789334852922,"field":"severity","old":"none","new":"high"},{"seq":173511,"id":"CVE-2026-78839","ts":1789333641128,"field":"cvss","old":"8.1","new":null},{"seq":173510,"id":"CVE-2026-78839","ts":1789333641128,"field":"severity","old":"high","new":"none"},{"seq":172325,"id":"CVE-2026-78839","ts":1789331080390,"field":"cvss","old":null,"new":"8.1"},{"seq":172324,"id":"CVE-2026-78839","ts":1789331080390,"field":"severity","old":"none","new":"high"},{"seq":171139,"id":"CVE-2026-78839","ts":1789328750686,"field":"cvss","old":"8.1","new":null},{"seq":171138,"id":"CVE-2026-78839","ts":1789328750686,"field":"severity","old":"high","new":"none"},{"seq":169934,"id":"CVE-2026-78839","ts":1789327144388,"field":"cvss","old":null,"new":"8.1"},{"seq":169933,"id":"CVE-2026-78839","ts":1789327144388,"field":"severity","old":"none","new":"high"}]}