Arbitrary file upload in 9front

CVE-2026-9053

Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element.

Vulnerability class: Unrestricted File Upload

EPSS: 0.001 (17.6th percentile) — read the EPSS interpretation.