AppNitro MachForm 30 Shell Upload

# CVE-2026-78839
    
    ## Description
    An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted `.phar` file.
    
    Successful exploitation of this issue requires two practical caveats. First, an attacker must either identify an existing form that has been configured to permit `.phar` file uploads, or possess sufficient access to edit a form's allowed extensions themselves. Second, the attacker must be able to determine the MD5 hash assigned to the uploaded file in order to retrieve and execute it, This can be either be achieved by brute-force of file names as unlimited requests can be sent in an attempt to enumerate valid filenames, or may be disclosed through secondary vulnerabilities.
    
    ## Attack Vectors
    If a user with form creation rights makes a form with file upload functionality where `.phar` format is allowed, any unauthenticated user can exploit this form to obtain Remote Code Execution. The unauthenticated user will need to bruteforce the random MD5 hash file name to retrieve the file and execute the attack.
    
    ## Affected Component
    Tested on Machform - version 30
    
    ## Attack Type
    Remote
    
    ## Risk
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P (8.2 High)
    
    ## Reference
    `https://<application-baseurl>/upload.php`
    
    ## Researcher
    Nabeel Khan - NCCGroup