CVE-2022-31041

Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ...). The input validation of uploaded files is insufficient in versions prior to 1.0.9 and 1.1.1. Users could alter or strip file extensions to bypass this validation. This results in files being uploaded to the server that are of a different file type than indicated by the file name extension. These files may be downloaded (manually or automatically) by staff and/or other applications for further processing. Malicious files can therefore find their way into internal/trusted networks. Versions 1.0.9 and 1.1.1 contain patches for this issue. As a workaround, an API gateway or intrusion detection solution in front of open-forms may be able to scan for and block malicious content before it reaches the Open Forms application.

• CWE-20
• CWE-434

• https://github.com/open-formulieren/open-forms/commit/0978a29e821a7228c5d46c0527c3e925eb91b071Patch, Third Party Advisory
• https://github.com/open-formulieren/open-forms/security/advisories/GHSA-h85r-xv4w-cg8gThird Party Advisory
• https://github.com/open-formulieren/open-forms/commit/0978a29e821a7228c5d46c0527c3e925eb91b071Patch, Third Party Advisory
• https://github.com/open-formulieren/open-forms/security/advisories/GHSA-h85r-xv4w-cg8gThird Party Advisory

Published

Jun 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31036Argo CD is a declarative, GitOps continuous delivery tool fo…4.3
• CVE-2022-31037OroCommerce is an open-source Business to Business Commerce …5.4
• CVE-2022-31038Gogs is an open source self-hosted Git service. In versions …5.4
• CVE-2022-31039Greenlight is a simple front-end interface for your BigBlueB…5.3
• CVE-2022-3104An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31040Open Forms is an application for creating and publishing sma…6.1
• CVE-2022-31042Guzzle is an open source PHP HTTP client. In affected versio…7.5
• CVE-2022-31043Guzzle is an open source PHP HTTP client. In affected versio…7.5
• CVE-2022-31044Rundeck is an open source automation service with a web cons…7.5
• CVE-2022-31045Istio is an open platform to connect, manage, and secure mic…9.8
• CVE-2022-31046TYPO3 is an open source web content management system. Prior…4.3
• CVE-2022-31047TYPO3 is an open source web content management system. Prior…6.5