High severity · published Oct 8, 2025
CVE-2025-11436
JhumanJ OpnForm answer unrestricted upload
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as 95c3e23856465d202e6aec10bdb6ee0688b5305a. It is advisable to implement a patch to correct this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpnForm · JhumanJ
1.9.0; 1.9.1; 1.9.2; 1.9.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11436
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11436
Exploit
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.dm5ttliupfqn
Patch
https://github.com/JhumanJ/OpnForm/pull/900/commits/95c3e23856465d202e6aec10bdb6ee0688b5305a
Permissions Required
https://vuldb.com/?ctiid.327373
Third Party Advisory
https://vuldb.com/?id.327373
Third Party Advisory
https://vuldb.com/?submit.666877
More from OpnForm
6.3
CVE-2025-11438
JhumanJ OpnForm API Endpoint custom-domains authorization
6.1
CVE-2025-11435
JhumanJ OpnForm submissions cross site scripting
5.9
CVE-2025-11443
JhumanJ OpnForm Forgotten Password email information exposure
4.8
CVE-2025-11437
JhumanJ OpnForm Form Editor forms cross site scripting
4.3
CVE-2025-11442
JhumanJ OpnForm API Endpoint cross-site request forgery