HotCRP's formula engine was compromised by a missing sanitization step introduced in April 2024 that caused PHP code generated from user supplied formulas to run unfiltered. The flaw allows an attacker with formula creation rights to inject and execute arbitrary PHP code on the server, leading to full compromise of the HotCRP instance, including theft of credentials, data exfiltration, or modification of reviews.

Affected vendor: Kohler HotCRP (conference review software). The vulnerability exists in all 3.1 releases that include the April 2024 patch, and is resolved starting with release version 3.2. No other product versions are listed as impacted, but any installation running HotCRP 3.1 or earlier is potentially vulnerable.

The CVSS base score is 10, indicating maximum severity. The EPSS score is below 1%, suggesting exploitation probability is currently very low. The vulnerability is not present in the CISA KEV catalog. Likely exploitation requires the attacker to create or edit a formula through the web UI, which usually requires at least reviewer or author rights, so the attack vector is remote via the web interface from an authenticated user with formula privileges.