CVE-2026-94589

Name of the Vulnerable Software and Affected Versions Extensions For CF7 versions prior to 3.4.6

Description An arbitrary file upload flaw exists in the extcf7 submit function. The issue stems from missing file extension, MIME type, and size validation within the validation filter() of the signature field. Additionally, a bypass of the sanitize file name() function allows the conversion of filenames like shell.php- into shell.php. Combined with a lack of PHP-execution guards in the upload directory, unauthenticated attackers can upload executable files, potentially leading to remote code execution (RCE), which is the ability to execute arbitrary commands on the server.

Recommendations Update Extensions For CF7 to version 3.4.6 or later. Restrict vulnerable form functionality until the update is applied. Block PHP execution in upload directories.