What is the CVSS score of CVE-2026-48613?

CVE-2026-48613 has a CVSS 3.0 base score of 5.9 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of phpBB are affected by CVE-2026-48613?

phpBB forum software contains a SQL injection vulnerability (CVE-2026-48613) exploitable by authenticated users through the profile field migration routine.

How to fix or mitigate CVE-2026-48613?

Within 24 hours: Identify all phpBB deployments and document which versions are currently running; identify affected systems (3.3.8 through 3.3.10). Within 7 days: Restrict profile modification access to administrators only; implement database access controls and activity logging. Within 30 days: Deploy phpBB version 3.3.11 or later when released by the vendor.

phpBB CVE-2026-48613

EUVD-2026-36382 MEDIUM

SQL Injection (CWE-89)

2026-06-12 hackerone

GHSA-x29j-7g7q-59rw

SQLi Phpbb

5.9

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

5.9 HIGH

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

vuln.today AI

5.9 MEDIUM

Network-reachable forum, but exploitation needs an authenticated user (PR:L), an admin-triggered migration (UI:R), and the narrow pre-3.3.8 upgrade state (AC:H); SQLi yields high confidentiality, partial integrity/availability.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Severity Changed

Jun 12, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

Jun 12, 2026 - 04:22 NVD

7.1 (HIGH) 5.9 (MEDIUM)

Analysis Generated

Jun 12, 2026 - 03:47 vuln.today

DescriptionCVE.org

SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies to phpBB forums that had been updated from versions prior to phpBB 3.3.8 and have not been updated to 3.3.11 or newer yet.

AnalysisAI

SQL injection in phpBB forum software allows authenticated users to execute arbitrary SQL queries through a flawed profile field migration routine. Only forums that were upgraded from a pre-3.3.8 release and have not yet reached 3.3.11 are affected, narrowing the exposed population to a specific upgrade window. No public exploit identified at time of analysis, and EPSS data was not provided.

Technical ContextAI

phpBB is a widely deployed open-source PHP/MySQL bulletin-board engine identified by CPE cpe:2.3:a:phpbb:phpbb. The flaw maps to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), originating in the migration code that converts legacy profile field data introduced before 3.3.8 into the newer schema. Because the migration consumes user-supplied profile field values without proper parameterization or escaping, attacker-controlled strings flow into a dynamically constructed SQL statement executed against the forum database, yielding an injection primitive in the database abstraction layer.

RemediationAI

Vendor-released patch: phpBB 3.3.11 - upgrade affected forums to 3.3.11 or later, which corrects the migration routine and remediates the SQL injection, per the advisory at https://www.phpbb.com/community/viewtopic.php?t=2672170. Until the upgrade can be performed, administrators of forums that came from pre-3.3.8 releases should defer running profile field migrations, restrict new account registration and profile field edits to trusted users, and add WAF rules that reject SQL meta-characters in custom profile field POST parameters (trade-off: legitimate users with apostrophes or special characters in profile data may be blocked); database account privileges used by phpBB should also be limited to the forum schema to reduce blast radius. Ensure a full database backup is taken before upgrading because the migration path itself is the affected code.