CVE-2026-23836
Published: 19 January 2026
Summary
CVE-2026-23836 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Hotcrp Hotcrp. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23836 is a critical vulnerability in HotCRP, an open-source conference review software, stemming from inadequately sanitized code generation for HotCRP formulas. Introduced in version 3.1 in April 2024, the flaw (classified under CWE-20: Improper Input Validation) enables the execution of arbitrary PHP code. It carries a CVSS v3.1 base score of 9.9, reflecting its network accessibility, low attack complexity, low required privileges, lack of user interaction, scope change, and high impacts on confidentiality, integrity, and availability.
Low-privileged users (PR:L) with network access (AV:N) can exploit this vulnerability without user interaction (UI:N). Successful exploitation allows attackers to execute arbitrary PHP code on the server, potentially leading to full system compromise, data exfiltration, modification of conference data, or further lateral movement given the scope change (S:C) and high impact ratings (C:H/I:H/A:H).
The GitHub security advisory (GHSA-hpqh-j6qx-x57h) and related commits detail the patch in HotCRP release version 3.2, which addresses the sanitization issue in formula code generation. Security practitioners should upgrade to version 3.2 or later and review access controls for formula usage in affected deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3305
Vulnerability details
HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release…
more
version 3.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-23836 allows low-privileged remote attackers to execute arbitrary PHP code on the public-facing HotCRP web application due to improper input validation in formula code generation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CWE-20 improper input validation in HotCRP formula code generation by enforcing validation mechanisms at input points to prevent arbitrary PHP code execution.
Mandates timely flaw remediation, such as patching HotCRP from version 3.1 to 3.2, to eliminate the specific sanitization vulnerability.
Enforces least privilege to restrict low-privileged user access to formula features, reducing the ability to trigger the code execution vulnerability.