Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description requires admin or feed-management privileges (PR:H) over the network with low complexity; impact is confidentiality-only information disclosure, so I:N/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can enumerate internal services (ports) or expose the original IP address of the server.
AnalysisAI
Server-side request forgery in XenForo 2.3.8 lets privileged forum operators abuse the RSS feed feature to make the server issue arbitrary outbound requests, enabling internal port scanning, internal service enumeration, and disclosure of the origin server's real IP address behind proxies or CDNs. Exploitation requires administrator access or the ability to add and save RSS feeds, so it is a post-authentication weakness rather than a fully unauthenticated one. Publicly available exploit code exists via the disclosure write-up, EPSS probability is low (0.24%), and it is not listed in CISA KEV.
Technical ContextAI
XenForo is a commercial PHP-based forum/community platform. The vulnerability is classified as CWE-918 (Server-Side Request Forgery): the RSS feed ingestion feature fetches a user-supplied URL server-side without adequately restricting the destination, so an operator can point it at internal hosts (e.g., 127.0.0.1, RFC1918 ranges, cloud metadata endpoints) or arbitrary ports. Because the fetch originates from the application server, response timing and behavior differences reveal which internal ports/services are reachable, and forcing the server to connect to an attacker-controlled endpoint exposes the true origin IP even when the site sits behind a reverse proxy or CDN. The CPE data in the feed is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not authoritatively bound affected products, so version scoping relies on the description naming 2.3.8.
RemediationAI
No vendor-released patch is identified at time of analysis in the provided data, so verify the current fixed release directly with XenForo at https://xenforo.com and monitor for an update beyond 2.3.8, applying it once available. As compensating controls, restrict who holds administrator and RSS-feed management permissions to a minimal trusted set, since the attack requires that privilege; if RSS feed functionality is not needed, disable or remove feed creation entirely, accepting loss of automated feed syndication. At the network layer, apply egress filtering from the web server so it can only reach the specific external hosts required for legitimate feeds, blocking outbound access to RFC1918 ranges, localhost, and cloud metadata IP 169.254.169.254 - this prevents internal enumeration but requires an allowlist of legitimate feed sources and may break feeds if maintained carelessly. Review the disclosure at https://github.com/dennywise/CVE-2026-51833-Public-Disclosure/blob/main/CVE-2026-51833.md for exact reproduction details.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today