High · published January 30, 2026
⚡ A single crafted document link can turn your conference review into a playground for attackers! Think of it like a hotel where all the room keys were given out without checking who they belonged to; anyone could waltz into any room! In this case, the document delivery method let malicious files run in your browser with access to your HotCRP credentials, just like an intruder finding a way into your personal space. An attacker could upload a malicious document disguised as a legitimate submission, and upon clicking the link, users would be vulnerable to cross-site scripting attacks. This could lead to unauthorized access to sensitive data or even give the attacker full control over the HotCRP API. Definitely not the type of surprise you want during a conference!
Think of it like a hotel where all the room keys were given out without checking who they belonged to; anyone could waltz into any room! In this case, the document delivery method let malicious files run in your browser with access to your HotCRP credentials, just like an intruder finding a way into your personal space. This vulnerability arises from improperly handling Content-Disposition headers, allowing non-permitted file types to be rendered inline in the user's browser, which poses a risk for executing arbitrary JavaScript from malicious documents.
An attacker could upload a malicious document disguised as a legitimate submission, and upon clicking the link, users would be vulnerable to cross-site scripting attacks. This could lead to unauthorized access to sensitive data or even give the attacker full control over the HotCRP API. Definitely not the type of surprise you want during a conference! Immediately update to HotCRP version 3.2.1 to patch this vulnerability. Additionally, ensure that the `save=0` parameter is disabled to prevent inline delivery of risky document types. Regularly review and audit uploaded documents to ensure compliance with security practices. You've got this! With these measures in place, you'll keep your HotCRP instance secure and ready for action! 🛡️