MachForm 31 Released. Security Update.
MachForm v31 is now available for download via your Account Area. This release addresses multiple security vulnerabilities identified in the previous version. We strongly recommend updating your installation immediately.
The CVE records for these issues were published in September, before a fixed version was available. We should have released these fixes sooner, and we have changed our process so that security fixes reach you faster.
Security Patches
- File Upload Code Execution (CVE-2026-78839): MachForm blocks executable PHP files on the server, regardless of a form’s allowed file types, but the .phar extension was missing from that block list. If a form was configured to accept .phar files, an uploaded file could run as code on the server. v31 adds .phar and several other executable extensions to the server-side block list.
- Entries Grid Widget Filter (CVE-2026-78837): The filter in the Entries Grid widget accepted column names beyond the columns shown in the widget. v31 only allows filtering and sorting on the widget’s displayed columns.
- Reflected Cross-Site Scripting (CVE-2026-78838): Database error messages on the entries grid datasource, shown by default, could echo back text from the request. v31 hides technical error messages by default.
About the Published CVEs
None of these issues can be exploited in a default MachForm installation, and the published CVE records describe some of them more broadly than the actual findings. The scores shown on cve.org were added later by CISA, based on the short CVE descriptions.
| CVE | Published as | Published score | Actual scope |
|---|---|---|---|
| CVE-2026-78837 | SQL injection | 7.5 High | Limited to the Entries Grid widget filter. Cannot modify data or run other SQL |
| CVE-2026-78838 | Reflected XSS | Not scored | Required database error messages to be displayed, the v30 default |
| CVE-2026-78839 | File upload code execution | 8.1 High | Requires a form set to accept .phar files, plus the file’s random storage path |
CVE-2026-78837. Input to the grid widget filter is limited to letters, numbers and underscores, and cannot break out of the database query. It cannot run other SQL commands, modify or delete data, or reach any other form, user account or setting. Its effect is limited to the single form connected to a published Entries Grid widget: it could reveal that form’s MySQL table field names from the error messages.
CVE-2026-78839. We agree the impact would be serious if exploited, which is why the published score is High. Exploitation requires two conditions that are not present by default. First, a form must be configured in the admin panel to accept .phar files, which legitimate forms would not normally do. Second, the attacker must know the uploaded file’s storage path, which contains a 128-bit random token generated for each upload and not returned to the uploader.
Acknowledgments
We thank Nabeel Khan of NCC Group for identifying and reporting these issues.
PHP & MySQL Version Requirements
MachForm v31 requires the minimum version of PHP on your server to be at least PHP 8.1 and MySQL version at least MySQL 5.7. If you’re still using an older version, you’ll need to upgrade your PHP and/or MySQL version first.
How to Update
This update is provided at no cost for users with an active support contract. You can download the package from the Account Area.
Please follow the official upgrade guide here: Upgrading MachForm Self-Hosted