CVE-2026-61529

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...