CVE-2025-11436: JhumanJ OpnForm Auth Bypass Vulnerability

CVE-2025-11436 Overview

CVE-2025-11436 is an unrestricted file upload vulnerability in JhumanJ OpnForm through version 1.9.3. The flaw resides in unspecified functionality of the /answer endpoint. Attackers with low-privilege authenticated access can manipulate input to upload files without proper restrictions. The issue is classified under CWE-284: Improper Access Control. The exploit has been disclosed publicly, increasing the likelihood of opportunistic abuse against unpatched deployments. A fix has been merged in commit 95c3e23856465d202e6aec10bdb6ee0688b5305a. OpnForm is an open-source form builder used to collect responses through public-facing forms, making exposed instances reachable over the network.

Critical Impact
Authenticated remote attackers can upload arbitrary files to OpnForm instances through the /answer endpoint, with public exploit details available.

Affected Products

JhumanJ OpnForm versions up to and including 1.9.3
Self-hosted OpnForm deployments exposing the /answer endpoint
Any OpnForm instance not updated with commit 95c3e23856465d202e6aec10bdb6ee0688b5305a

Discovery Timeline

2025-10-08 - CVE-2025-11436 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11436

Vulnerability Analysis

The vulnerability stems from missing access control on file upload handling at the /answer endpoint in OpnForm. The /answer route processes form submissions from respondents and accepts attached files. Without strict validation of file type, size, or upload authorization, an attacker can submit crafted payloads that bypass intended restrictions. Public exploit information is available, and the attack can be launched over the network. The EPSS score is approximately 0.071%, reflecting limited observed exploitation attempts at this time. The associated weakness, CWE-284, captures the failure to enforce proper restrictions on who may perform an action or what content may be supplied.

Root Cause

The root cause is improper access control on the file upload path handling form answers. The endpoint does not adequately constrain the type or contents of uploaded files, nor does it sufficiently restrict the action to expected actors. The maintainer addressed this in pull request 900 via commit 95c3e23856465d202e6aec10bdb6ee0688b5305a, available in the JhumanJ OpnForm GitHub repository.

Attack Vector

An attacker with low-privilege credentials sends a crafted HTTP request to the /answer endpoint of an exposed OpnForm instance. The request contains an attachment that the application accepts without sufficient restriction. Because the attack vector is network-based and complexity is low, exploitation requires no user interaction beyond submitting the request. Public proof-of-concept information increases the practical risk for internet-facing deployments. Additional technical context is available at the VulDB entry for this issue.

Detection Methods for CVE-2025-11436

Indicators of Compromise

Unexpected files written to OpnForm upload directories with non-standard extensions or MIME types
HTTP POST requests to /answer containing oversized or unusual multipart/form-data payloads
New or unknown files appearing in storage paths associated with form attachments
Outbound network connections originating from the OpnForm application server following form submission activity

Detection Strategies

Inspect web server and application logs for POST /answer requests with anomalous file extensions or content types
Compare deployed OpnForm version against 1.9.3 and verify the presence of commit 95c3e23856465d202e6aec10bdb6ee0688b5305a
Correlate uploads with subsequent process execution or file access events on the application host
Apply file integrity monitoring to the OpnForm storage directory to flag unauthorized additions

Monitoring Recommendations

Forward OpnForm application logs and reverse proxy logs to a centralized logging or SIEM platform for correlation
Alert on submissions to /answer that produce executable or script files (.php, .phtml, .jsp, .html)
Track baseline submission volume per form to identify anomalous spikes consistent with abuse
Monitor the OpnForm host for unexpected child processes spawned by the web server user

How to Mitigate CVE-2025-11436

Immediate Actions Required

Apply the upstream patch from commit 95c3e23856465d202e6aec10bdb6ee0688b5305a and upgrade beyond OpnForm 1.9.3
Audit the OpnForm uploads directory for unauthorized files created since deployment
Restrict network exposure of OpnForm administrative and submission endpoints where feasible
Rotate API tokens and credentials if signs of compromise are observed

Patch Information

The maintainer has merged a fix referenced by commit hash 95c3e23856465d202e6aec10bdb6ee0688b5305a in pull request 900. Operators should pull the latest release from the JhumanJ OpnForm repository and rebuild or redeploy affected containers. Confirm the patched commit is present in the running image before returning the service to production.

Workarounds

Place OpnForm behind a web application firewall and block requests to /answer containing executable file extensions
Enforce strict MIME type and extension allow-lists at the reverse proxy for form attachment uploads
Mount the uploads directory with noexec to prevent execution of files written through the application
Disable file attachment fields on public forms until the patch is applied

bash

# Example nginx rule blocking executable uploads to the /answer endpoint
location /answer {
    if ($request_method = POST) {
        if ($http_content_type ~* "(php|phtml|jsp|exe|sh)") {
            return 403;
        }
    }
    proxy_pass http://opnform_backend;
}