Cyber Posture

CVE-2026-31049

CriticalUpdated

Published: 14 April 2026

Published
14 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0035 57.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-31049 is a critical-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Hostbillapp (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the missing server-side validation of CSV registration fields to prevent arbitrary code execution from malicious inputs.

prevent

Ensures timely patching of the specific flaw in Hostbill CSV handling as detailed in vendor advisories and release notes.

prevent

Restricts the insertion of unauthorized or malformed CSV content into registration processes to block exploitation vectors.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Unauthenticated remote exploitation of a public-facing web application's CSV registration field enables arbitrary code execution (T1190) and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field

Deeper analysisAI

CVE-2026-31049 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting Hostbill versions 2025-11-24 and 2025-12-01. The issue, classified under CWE-1236, enables a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field. Published on 2026-04-14, it represents a severe flaw in the application's handling of CSV imports during registration processes.

Any remote attacker with network access can exploit this vulnerability due to its low attack complexity, lack of required privileges or user interaction, and unchanged impact scope. Exploitation through the CSV registration field allows achievement of high impacts on confidentiality, integrity, and availability, culminating in arbitrary code execution and privilege escalation on the affected Hostbill instance.

Vendor-provided resources detail potential mitigations, including a security advisory at https://blog.hostbillapp.com/2025/12/03/hostbill-security-advisory/, changelog at https://hostbillapp.com/changelog, and release notes for versions 11-27-2025 and 12-01-2025 at https://hostbillapp.com/release-notes/11-27-2025.html and https://hostbillapp.com/release-notes/12-01-2025.html. A GitHub repository at https://github.com/Muhammad5235/HostBill-CVEs-2025/blob/main/Missing%20Server-Side%20Validation/Registration%20fields%20%26%20Import%20Csv documents the missing server-side validation underlying the flaw.

Details

CWE(s)

Affected Products

Hostbillapp
inferred from references and description; NVD did not file a CPE for this CVE

CVEs Like This One

CVE-2023-53913Shared CWE-1236
CVE-2024-55532Shared CWE-1236
CVE-2025-55745Shared CWE-1236
CVE-2024-45084Shared CWE-1236
CVE-2020-36962Shared CWE-1236
CVE-2026-35157Shared CWE-1236
CVE-2024-47572Shared CWE-1236
CVE-2020-36941Shared CWE-1236
CVE-2023-54348Shared CWE-1236
CVE-2021-47901Shared CWE-1236

References