CVE-2026-50878

Vulnerability

Feuerhamster MailForm v1.1.0, an email form handler, uses Formidable to parse multipart uploads in the route /:target (src/router.ts). The application fails to remove the temporary files created by the parser after processing the email delivery path in src/services/email.ts. This missing cleanup occurs on both failure paths (e.g., unreachable SMTP) and possibly after successful delivery, depending on parser behavior. Affected version: v1.1.0 [1].

Exploitation

An attacker must be able to submit a multipart POST request to a configured /:target route with an attachment. No authentication is required if the form endpoint is public. By repeatedly sending such requests — especially with delivery settings that cause email sending to fail — each submission creates a new temporary file in the server's temporary directory without deletion. The attacker can automate many submissions to progressively fill the filesystem [1].

Impact

Successful exploitation results in persistent accumulation of temporary files in the server's temporary directory. This can lead to denial of service (DoS) via disk space exhaustion. Additionally, if other local users or processes have access to the temporary directory, the residual attachment files may expose sensitive data from submissions [1].

Mitigation

No fix has been released as of the publication date (2026-06-15). The vendor should implement explicit cleanup of temporary files after the email-sending routine completes, regardless of success or failure. Until a patch is available, administrators can mitigate by restricting access to the upload endpoint, setting filesystem disk quotas, or running a cron job to periodically clean the temporary directory of files older than the maximum expected form processing time [1].