Vulnerability Description
The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prior, the quickUpload() endpoint validates uploaded files by checking their MIME type (via PHP's finfo, which inspects file contents) but constructs the stored filename using the client-supplied file extension from getClientOriginalExtension(). These two checks are independent: an attacker can upload a file whose content passes the MIME allowlist while using a .php extension. The file is stored on the public disk and is directly accessible via URL, allowing server-side code execution. At time of publication no known patches exist.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-34735?
CVE-2026-34735 is a documented vulnerability. The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prior, the quickUpload() endpoint validates uploaded files by checking their MIME ty...
How severe is CVE-2026-34735?
CVSS scoring is not yet available for CVE-2026-34735. Check NVD for updates.
Is there a patch for CVE-2026-34735?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.