An unrestricted file upload flaw was discovered in the Ajax upload handler of Form Tools versions up to 3.1.1. The flaw allows an attacker to upload arbitrary files through the Files::uploadFile function without proper validation, potentially enabling them to deliver malicious code or content. This weakness is scored as a moderate severity CVSS of 5.3 and can lead to compromise of confidentiality and integrity if the uploaded files are executed or used to exfiltrate data. The vulnerability arises from inadequate access control (CWE‑284) and lack of file type validation (CWE‑434).

The issue affects the Form Tools component from formtools.org, specifically any installation running a version of the software older than or equal to 3.1.1. Version details are not enumerated beyond the upper bound, so any 3.0.x or 3.1.1 iteration is subject to the vulnerability. No other vendors or products are currently listed as impacted.

The vulnerability is exploitable remotely via the Ajax interface, with the public exploit already available on GitHub and other vulnerability databases. Because the CSRF token and other typical web application protections are not mentioned, an attacker may directly target the upload endpoint. While the EPSS score is left out, the public disclosure and availability of an exploit suggest that threat actors could exploit the flaw sooner rather than later. The CVSS of 5.3 indicates a moderate risk, and the absence from the KEV catalog means no confirmed large‑scale exploitation has been reported yet. Nonetheless, the potential for Remote File Upload and subsequent code execution warrants timely remediation.