EUVD-2026-17743Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.
AnalysisAI
Remote code execution in XenForo versions prior to 2.3.9 and 2.2.18 allows authenticated administrators to execute arbitrary code on the server. Attack requires low-privilege admin panel access (PR:L) with network accessibility (AV:N) and low complexity (AC:L). No public exploit identified at time of analysis, though VulnCheck published technical analysis. This represents a supply-chain or insider-threat risk where compromised admin credentials or malicious insiders could achieve complete server compromise.
Technical ContextAI
XenForo is a PHP-based forum software platform. This vulnerability stems from CWE-94 (Improper Control of Generation of Code / Code Injection), indicating inadequate input validation or sanitization of data processed by authenticated administrators. The admin panel likely accepts user-controlled input that is subsequently evaluated or executed as code without sufficient restrictions. Given the PHP ecosystem typical to XenForo (cpe:2.3:a:xenforo:xenforo), this could involve unsafe use of functions like eval(), unserialize(), or template engine exploits that permit code injection when admin-level users supply crafted payloads. The CVSS vector confirms network-accessible exploitation with no user interaction required once admin access is obtained.
RemediationAI
Upgrade immediately to XenForo 2.3.9 or later for 2.3.x installations, or XenForo 2.2.18 or later for 2.2.x installations per the official vendor security advisory at https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/. No workarounds are documented; patching is the only confirmed mitigation. As an interim risk reduction measure, organizations should audit admin user accounts, enforce strong authentication with MFA for admin panel access, monitor admin activity logs for suspicious behavior, and restrict admin panel access to trusted IP ranges via firewall rules or web application firewall policies. Review and revoke unnecessary admin privileges following least-privilege principles.
Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Xenforo before 2.2.16 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authen
Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unaut
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code f
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored**
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertisi
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signa
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloa
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators
Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through
OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to req
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today