Critical · published January 19, 2026
🚨 A tiny oversight in HotCRP's formula handling unleashes a big threat: users can execute arbitrary PHP code, just like sending a script disguised as an innocent request! 🔥 Think of it like an office supply order form that lets anyone write in their own items without approval — one sneaky addition could lead to a shipment of chaos instead of stationery! If exploited, an attacker could take complete control of the server, executing any code they want — from stealing sensitive data to causing complete system failure. This is no minor risk; we're talking about potential data breaches that could compromise the entire conference review process!
Think of it like an office supply order form that lets anyone write in their own items without approval — one sneaky addition could lead to a shipment of chaos instead of stationery! This vulnerability stems from inadequately sanitized code generation in HotCRP formulas, allowing users to insert and execute arbitrary PHP code. The flaw was introduced in version 3.1, and it's a critical issue that can be easily manipulated.
If exploited, an attacker could take complete control of the server, executing any code they want — from stealing sensitive data to causing complete system failure. This is no minor risk; we're talking about potential data breaches that could compromise the entire conference review process! To protect your system, immediately update to HotCRP version 3.2 where this vulnerability is patched. Also, review your current installation to ensure no malicious formulas were executed. Regular system audits can help mitigate potential risks in the future! You've got this! Secure your HotCRP setup and keep those conference reviews safe from chaos! 🛡️