CVE-2026-23836 HotCRP vulnerable to remote code execution through formulas

Critical 10.0 Published 19 Jan 2026 Updated 20 Jan 2026

Attackers can execute arbitrary PHP code via unsanitized HotCRP formulas, requiring an upgrade to the patched version.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-23836?

CVE-2026-23836 is a critical code injection vulnerability in kohler hotcrp, published on 19 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release version 3.2.

Weakness: CWE-20

Which versions are affected by CVE-2026-23836?

It affects 1 product.

Products include Hotcrp Hotcrp.

How do I fix CVE-2026-23836?

No fix has been published for CVE-2026-23836 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-23836 being exploited?

There is no known exploitation of CVE-2026-23836 in the wild and no public exploit code.

Sources

Also known as GHSA-hpqh-j6qx-x57h.