CVE-2026-9053

{"id": "CVE-2026-9053", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9053", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T12:35:42.430223Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "1d66c9f9-fff2-411a-aa19-ca6312fa25e9", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 6.9, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:L/U:Amber", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "1d66c9f9-fff2-411a-aa19-ca6312fa25e9", "affectedData": [{"repo": "https://git.9front.org/plan9front/9front/HEAD/info.html", "vendor": "9front", "modules": ["mothra"], "product": "9front", "versions": [{"status": "affected", "version": "f04e113279274526a8dae34de373027b68921fbf", "lessThan": "d145acc9ef0da47131af6ad94e87264e04870d47", "versionType": "git"}], "platforms": ["x86", "32 bit", "64 bit"], "packageName": "mothra", "programFiles": ["/sys/src/cmd/mothra/forms.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "rdform()"}]}]}], "published": "2026-05-22T04:16:28.430", "references": [{"url": "https://git.9front.org/plan9front/9front/d145acc9ef0da47131af6ad94e87264e04870d47/commit.html", "source": "1d66c9f9-fff2-411a-aa19-ca6312fa25e9"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element."}, {"lang": "es", "value": "Mothra respetar\u00eda un valor predeterminado proporcionado por un sitio web para formularios de carga de archivos HTML. Un atacante podr\u00eda dise\u00f1ar un sitio web con una ruta de archivo predeterminada maliciosa y luego ocultar este elemento del formulario."}], "lastModified": "2026-07-23T16:10:00.137", "sourceIdentifier": "1d66c9f9-fff2-411a-aa19-ca6312fa25e9"}