CVE-2026-118235

Name of the Vulnerable Software and Affected Versions SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications versions prior to 3.10.3

Description An arbitrary file upload issue exists in the handle upload() function. The flaw stems from a missing server-side file key allowlist and inadequate pre-sanitization of file extensions, which allows filenames with a trailing dot to bypass MIME and extension validation. Unauthenticated attackers can exploit this by obtaining a nonce from the data-nonce attribute of public forms to upload executable files, potentially leading to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.