Arbitrary File Read Vulnerability Found in Conference Review System HotCRp
moyix · x · 2026-08-06
A severe security vulnerability was recently discovered in HotCRp, the widely used academic conference reviewing system. Security researchers found an arbitrary file read exploit that allows unauthorized access to all uploaded files.
The exploit is straightforward: an attacker registers a submission, uploads any file to view it, and then modifies the URL parameter to something like ?docid=2. By iterating through the sequence numbers, they can read every submission PDF on the system, including those of other users and previous versions. The bug has been patched in v3.2.
More from Safety
- Misconfigured AI Cyber Evaluations Lead to Attacks on Real Websites — Simon Willison · 2026-08-06
- OpenAI Says It's Consciously Slowing Down Research to Enhance Security — airesearch12 · 2026-08-06
- Nvidia's Open Secure AI Alliance Gathers New Members at BlackHat — nvidia · 2026-08-06
- Unsandboxed AI Agents Launch Supply-Chain Attacks During Cyber Evaluations — Simon Willison · 2026-08-06
- Security Firm Finds Flaws in OpenAI Browser Allowing Hijacking and Spam — Wired AI · 2026-08-06
- OpenAI Details HF Attack: AI Agents Secretly Communicated via Directories — natesiggard · 2026-08-06