The vulnerability CVE-2026-103541 affects Form Tools versions 3.1.0 and 3.1.1. It arises from the Files::uploadFile function in global/code/actions.php, part of the Ajax Handler component, which does not properly restrict file uploads. This flaw enables remote attackers to upload arbitrary files to the server. The issue was reported early to the project, but no fix or official response has been provided. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to upload files without restriction, potentially leading to unauthorized file placement on the server. This could facilitate further attacks depending on the uploaded file's nature, such as code execution or defacement. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low complexity, no user interaction, and partial impacts on confidentiality, integrity, and availability.

No official patch or fix is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restricting access to the vulnerable upload functionality and implementing compensating controls such as web application firewalls or upload filtering may reduce risk.