EUVD-2026-72759
GHSA-fxw8-p3x8-7xqx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, low complexity once privileged; PR:H for required admin-with-style-permission account; S:U as code executes within the existing web-server account scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names. Attackers can craft a malicious ZIP archive with backslash path separators that bypass forward-slash validation to write arbitrary bytes to any web-server-writable path, including the public web root, achieving persistent code execution as the web-server account.
AnalysisAI
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators holding style-import permissions to write arbitrary files outside the intended extraction directory. By crafting a ZIP archive with backslash-delimited member names, an attacker bypasses the forward-slash-only traversal validation enforced on Linux/macOS, writing arbitrary bytes to any path writable by the web-server account - including the public web root - resulting in persistent server-side code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) XenForo running on a Windows host where the OS resolves backslash as a directory separator; (2) an authenticated session as a non-super administrator account that has been granted style-import/management permissions - this is a delegated admin role, not a default low-privilege user; (3) the web-server process account must have write access to at least one directory reachable via web (e.g., the public web root). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N - score 8.6) accurately captures the primary constraints: network-reachable, low attack complexity once credentials are in hand, but requiring high-privilege access (admin with style-import rights). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to XenForo 2.3.13 or later, released with targeted security fixes per the vendor thread at xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all XenForo instances running on Windows servers and audit which user accounts hold style-import permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Xenforo before 2.2.16 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authen
Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unaut
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code f
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored**
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertisi
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signa
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloa
Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through
OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to req
XenForo forum software versions prior to 2.3.7 disclose server filesystem paths through exception messages triggered by
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today