CVE-2026-34735 Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`
Attackers can upload malicious PHP files by bypassing MIME checks, leading to remote code execution on the Hytale Modding Wiki server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34735?
CVE-2026-34735 is a high-severity vulnerability in HytaleModding wiki, published on 2 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prior, the quickUpload() endpoint validates uploaded files by checking their MIME type (via PHP's finfo, which inspects file contents) but constructs the stored filename using the client-supplied file extension from getClientOriginalExtension(). These two checks are independent: an attacker can upload a file whose content passes the MIME allowlist while using a .php extension. The file is stored on the public disk and is directly accessible via URL, allowing server-side code execution. At time of publication no known patches exist.
Weakness: CWE-434
Which versions are affected by CVE-2026-34735?
How do I fix CVE-2026-34735?
No fix has been published for CVE-2026-34735 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-34735 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34735 exists.
Sources
Also known as GHSA-2xqq-6778-h4j9.