Which versions of Discuz! X5.0 are affected by CVE-2026-49954?

Discuz! X5.0 (versions 20260320-20260501) is vulnerable to administrative compromise enabling full web server takeover.

Is there a public PoC exploit available for CVE-2026-49954?

Yes, a public proof-of-concept exploit is available for CVE-2026-49954. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-49954?

24 hours: Identify all Discuz! X5.0 instances running versions 20260320-20260501; restrict admin account access and disable remote administration if possible. 7 days: Disable plugin import functionality via application configuration and implement MFA on all administrator accounts. 30 days: Migrate to patched release when vendor releases security update, or migrate to alternative platform if patch timeline exceeds organizational risk tolerance.

Discuz! X5.0 CVE-2026-49954

Q: What is the CVSS score of CVE-2026-49954?

CVE-2026-49954 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-36794 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-15 VulnCheck

GHSA-prqv-jwmw-qpp3

File Upload RCE LFI Path Traversal PHP Discuz X5 0

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.6 MEDIUM

Network-reachable admin panel justifies AV:N; race-condition-assisted sanitization bypass raises AC:H; administrator role required so PR:H; full CIA impact on the web server.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 19:54 vuln.today

DescriptionCVE.org

Discuz! X5.0 releases 20260320 through 20260501 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to be stored unsanitized and subsequently passed to include(), which combined with file upload functionality escalates to arbitrary code execution in the context of the web server user.

AnalysisAI

Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a path traversal flaw in the plugin import routine with file upload functionality to run arbitrary PHP as the web server user. Publicly available exploit code exists (published by Karma Insecurity / VulnCheck) demonstrating a race-condition-assisted bypass of sanitization, but the issue is not listed in CISA KEV and no public EPSS signal was provided. The high PR:H requirement limits attackers to those already holding administrator credentials or able to obtain them.

Technical ContextAI

Discuz! X5.0 is a widely deployed PHP-based forum and community platform from Comsenz/Tencent (CPE cpe:2.3:a:discuz!:discuz!_x5.0). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - a.k.a. PHP Remote File Inclusion / LFI). The plugin installation workflow parses a configuration archive containing a 'directory' attribute that is meant to identify a sandboxed plugin folder; the installer attempts to sanitize this value, but an exception raised mid-installation short-circuits sanitization, leaving raw '../' path-traversal sequences persisted in plugin state. That tainted directory string is later concatenated into an include() call, so any file the attacker can land on disk - most easily via the platform's own file-upload features - is interpreted as PHP. This is the same LFI-to-RCE primitive that has historically affected PHP CMS platforms whose plugin loaders treat persisted configuration as trusted.

RemediationAI

No vendor-released patch identified at time of analysis, so the primary action is to upgrade to a Discuz! X5.0 build later than 20260501 as soon as the vendor publishes one - track the VulnCheck advisory at https://www.vulncheck.com/advisories/discuz-x5-0-local-file-inclusion-via-enable-disable-php-plugin-directory and the Karma Insecurity write-up at https://karmainsecurity.com/KIS-2026-11 for the fixed build identifier. Until a patched build is available, restrict access to the admin control panel (admin.php and the plugin management endpoints) to a VPN or office IP allowlist, enforce MFA on all administrator accounts, and rotate any admin credentials that may have been shared, since the bug is only reachable with administrator privileges. As a deeper compensating control, disable the plugin import/enable-disable functionality at the web-server level (for example by denying access to the plugin installation script via an nginx or Apache location block) - this neutralizes the vulnerable code path but breaks the legitimate plugin install workflow until a patch is applied. Hardening PHP with open_basedir scoped to the Discuz! installation directory and forbidding writes to directories also covered by include paths will blunt the LFI-to-RCE escalation at the cost of breaking plugins that legitimately need broader filesystem access.