Discuz! X5.0 CVE-2026-49954

Requires an authenticated Discuz! X5.0 administrator session with permission to import and enable plugins, the ability to upload a file (any of the platform's file-upload endpoints, including attachments or avatars) that will be reachable on disk, and the ability to deliberately interrupt plugin installation with an exception to defeat sanitization of the plugin configuration's 'directory' attribute. The instance must be running an affected X5.0 release between 20260320 and 20260501; non-administrator users, sites running other Discuz! branches, and deployments where the admin control panel is not reachable from the attacker's network position cannot exploit this issue.

The provided CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N is internally consistent with the description: network-reachable admin panel, low complexity once authenticated, no user interaction, and full CIA impact on the web server. The headline 8.6 base score is meaningful but the PR:H requirement is the dominant risk-limiter - only an administrator (or an attacker who has phished/cred-stuffed one) can reach the vulnerable plugin import path, so this is not a mass-exploitation candidate. Publicly available exploit code (referenced as 'chaining-bugs-in-discuz-from-race-condition-to-rce') materially raises the risk for any organization whose admin panel is internet-exposed without IP allowlisting or MFA, because the race-condition trigger is documented end-to-end. EPSS and KEV signals were not provided in the input, so widespread automated exploitation cannot be confirmed; treat this as a high-priority patch for any Discuz! X5.0 operator but not an emergency on par with unauthenticated RCEs.

An attacker who has compromised or social-engineered a Discuz! X5.0 administrator account uploads an attacker-controlled file (for example an avatar or attachment containing PHP) through the standard upload features, then submits a malicious plugin configuration whose 'directory' attribute contains '../' sequences pointing back to the uploaded file. They deliberately trigger an exception during the plugin install to bypass sanitization, causing the traversal path to persist; enabling the plugin then drives include() to load and execute their uploaded PHP as the web server user. A public chained-exploit write-up demonstrating exactly this race-condition-to-RCE flow is available, so weaponization effort is minimal.