The vulnerability lies in the Hytale Modding Wiki’s quickUpload endpoint, which validates uploaded files only by inspecting MIME type with PHP’s finfo library. However, the filename stored on disk is built from the client‑supplied file extension without cross‑checking the MIME type against that extension. An attacker can therefore upload a file whose contents satisfy the allowed MIME type but whose extension is .php. The file is written to a publicly accessible directory and can be executed as PHP code, giving the attacker full remote code execution on the server. This is a type‑of‑upload‑vulnerability categorized as CWE‑434, capable of compromising confidentiality, integrity, and availability of the host system.

The flaw affects the Hytale Modding Wiki service, which hosts documentation and wikis for Hytale mods. Versions 1.2.0 and earlier are vulnerable, and no official patch has been released at the time of this advisory.

With a CVSS score of 8.7 the vulnerability is considered High. No EPSS score is available and the issue is not listed in CISA’s KEV catalog. The likely attack vector is remote via the public file‑upload API; the attacker only needs to supply a file that passes the MIME check while naming it with a .php extension. If the public upload directory allows execution of PHP files, the attacker immediately achieves remote code execution, which can lead to full system compromise.