{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.2.0"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "89dfb32585acb1978259287295ddf5ec96e191c3"
            }
          ],
          "repo": "https://github.com/hytalemodding/wiki",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-2xqq-6778-h4j9"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-434"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34735.json"
  },
  "details": "The Hytale Modding Wiki is a free service for Hytale mods to host their documentation \u0026 wikis. In version 1.2.0 and prior, the quickUpload() endpoint validates uploaded files by checking their MIME type (via PHP's finfo, which inspects file contents) but constructs the stored filename using the client-supplied file extension from getClientOriginalExtension(). These two checks are independent: an attacker can upload a file whose content passes the MIME allowlist while using a .php extension. The file is stored on the public disk and is directly accessible via URL, allowing server-side code execution. At time of publication no known patches exist.",
  "id": "CVE-2026-34735",
  "modified": "2026-07-27T03:56:14.724502669Z",
  "published": "2026-04-02T18:23:26.441Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34735.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/HytaleModding/wiki/security/advisories/GHSA-2xqq-6778-h4j9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34735"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`"
}