CVE-2026-23836

Critical

Published: 19 January 2026

Published

19 January 2026

Modified

18 February 2026

KEV Added

—

Patch

—

CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0016 36.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23836 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Hotcrp Hotcrp. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the CWE-20 improper input validation in HotCRP formula code generation by enforcing validation mechanisms at input points to prevent arbitrary PHP code execution.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation, such as patching HotCRP from version 3.1 to 3.2, to eliminate the specific sanitization vulnerability.

AC-6 Least Privilege partial match

prevent

Enforces least privilege to restrict low-privileged user access to formula features, reducing the ability to trigger the code execution vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2026-23836 allows low-privileged remote attackers to execute arbitrary PHP code on the public-facing HotCRP web application due to improper input validation in formula code generation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release…

version 3.2.

Deeper analysisAI

CVE-2026-23836 is a critical vulnerability in HotCRP, an open-source conference review software, stemming from inadequately sanitized code generation for HotCRP formulas. Introduced in version 3.1 in April 2024, the flaw (classified under CWE-20: Improper Input Validation) enables the execution of arbitrary PHP code. It carries a CVSS v3.1 base score of 9.9, reflecting its network accessibility, low attack complexity, low required privileges, lack of user interaction, scope change, and high impacts on confidentiality, integrity, and availability.

Low-privileged users (PR:L) with network access (AV:N) can exploit this vulnerability without user interaction (UI:N). Successful exploitation allows attackers to execute arbitrary PHP code on the server, potentially leading to full system compromise, data exfiltration, modification of conference data, or further lateral movement given the scope change (S:C) and high impact ratings (C:H/I:H/A:H).

The GitHub security advisory (GHSA-hpqh-j6qx-x57h) and related commits detail the patch in HotCRP release version 3.2, which addresses the sanitization issue in formula code generation. Security practitioners should upgrade to version 3.2 or later and review access controls for formula usage in affected deployments.