An arbitrary file upload flaw in AppNitro MachForm v30 allows attackers to upload a specially crafted .phar file that triggers code execution on the host server. The vulnerability gives the attacker full control over the application environment, potentially compromising the underlying operating system, databases, and any data the application handles. This type of flaw has a high confidentiality, integrity, and availability impact, as it may allow disclosure of sensitive data, modification of application logic, and the possibility of further lateral movement within the network.

AppNitro MachForm version 30 is affected. No other vendor or product is listed in the CNA data, but any deployment of this application version is susceptible to the flaw.

The vulnerability can be exploited via the web application's file upload interface, but the description does not state whether authentication is required; the attack is inferred to be possible by any user who can reach that endpoint. An attacker must craft a .phar file that contains malicious PHP or PHAR payloads; when the file is uploaded, the application processes it, triggering the embedded code and allowing arbitrary code execution. The CVSS score of 8.1 indicates high severity, while the EPSS score of < 1% suggests a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, but its remote code execution nature warrants careful mitigation.