Security readout for executives and security teams
Plain-English summary
HotCRP 3.2 could show uploaded HTML or SVG files directly in a user’s browser. If a logged-in user clicked a malicious attachment, code could run with access to their HotCRP session and potentially use HotCRP APIs as that user. The vendor reports no evidence of exploitation in documents uploaded to hotcrp.com.
Executive priority
Prioritize remediation for any internet-accessible HotCRP site using v3.2 or affected development builds. The issue can compromise conference review accounts through routine document viewing, but available sources do not show active exploitation. Patch promptly and review recent uploaded attachments if the site accepted HTML or SVG files.
Technical view
CVE-2026-25156 is stored XSS in HotCRP document delivery. Versions from the October 11, 2025 introducing commit through v3.2 delivered all document types with inline Content-Disposition. Malicious HTML or SVG uploaded through file upload fields or comment attachments could execute in a viewer’s browser. Fixed in commit 8933e86 and v3.2.1; v3.2.1 also removes save=0 support.
Likely exposure
Exposure is likely limited to HotCRP deployments running development builds after October 11, 2025 or HotCRP v3.2, especially sites allowing user-uploaded attachments or file upload submission fields. PDF upload fields are reported not vulnerable. Organizations not running HotCRP, or already on v3.2.1, are not indicated as affected by the provided sources.
Exploitation context
An attacker needs an account or upload capability and must convince a user to click a malicious document link. Successful exploitation requires user interaction but could expose HotCRP credentials and allow API actions as the victim. The CVE is not listed as KEV, and the advisory reports no evidence of exploitation in hotcrp.com uploaded documents.
Researcher notes
The affected behavior came from commit aa20ef288828b04550950cf67c831af8a525f508 and was fixed by 8933e86c9f384b356dc4c6e9e2814dee1074b323. The advisory states inline delivery was intended only for text, PDF, GIF, JPEG, and PNG. Malicious upload paths include file upload fields and comment attachments; PDF upload fields are excluded.
Mitigation direction
- Upgrade HotCRP to v3.2.1 or later per vendor guidance.
- Apply commit 8933e86 if maintaining a custom HotCRP build.
- Ensure support for save=0 is removed as in v3.2.1.
- Review vendor advisory before relying on configuration-only mitigations.
- Consider reviewing uploaded HTML and SVG attachments during the exposure window.
Validation and detection
- Inventory HotCRP deployments and confirm exact version or commit.
- Check whether deployments run v3.2 or post-October 11, 2025 development builds.
- Confirm v3.2.1 or fixing commit 8933e86 is present.
- Verify save=0 support has been removed in patched deployments.
- Review upload features that allow attachments or non-PDF file uploads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-25156 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N2.15.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/kohler/hotcrp/security/advisories/GHSA-p88p-2f2p-2476CVE reference · x_refsource_CONFIRM
- https://github.com/kohler/hotcrp/commit/8933e86c9f384b356dc4c6e9e2814dee1074b323CVE reference · x_refsource_MISC
- https://github.com/kohler/hotcrp/commit/aa20ef288828b04550950cf67c831af8a525f508CVE reference · x_refsource_MISC
- https://github.com/kohler/hotcrp/commit/c3d88a7e18d52119c65df31c2cc994edd2beccc5CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.