EUVD-2025-209158
GHSA-8fvj-rw6m-xrph
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While assigned a high CVSS 4.0 score of 8.7 based on network attack vector (AV:N), low complexity (AC:L), and no required privileges (PR:N) or user interaction (UI:N), the real-world severity is moderate. The CVSS vector shows high confidentiality impact (VC:H) but no integrity or availability impact, appropriately reflecting an information disclosure issue. EPSS data is not provided but would likely be low-to-moderate given the reconnaissance-only nature. No CISA KEV listing exists and no public exploit code is identified at time of analysis, indicating this is not being actively weaponized. The SSVC framework would classify this as technically low impact (reconnaissance only) and non-automatable for direct harm. The primary risk lies in enabling subsequent attacks: disclosed paths help attackers identify software versions, understand deployment architecture, locate configuration files, and craft targeted exploits for other vulnerabilities. For internet-facing XenForo installations, this represents a worthwhile fix during regular maintenance windows rather than emergency patching, though the availability of a simple version upgrade makes remediation straightforward. The risk escalates if combined with local file inclusion or directory traversal vulnerabilities in the same installation. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies a publicly accessible XenForo forum and crafts HTTP requests designed to trigger open_basedir restriction violations, such as attempting to access template files or upload directories outside the configured PHP basedir. The XenForo application generates unhandled exceptions that include full filesystem paths in error messages returned to the attacker's browser, revealing details like /var/www/html/xenforo/library/XenForo/ControllerPublic/ or /home/forumuser/public_html/internal/code/. Armed with this directory structure knowledge, the attacker maps the server architecture, identifies the software installation pattern, and uses this reconnaissance to develop targeted attacks against configuration files, locate backup directories, or craft exploitation chains with other vulnerabilities. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
XenForo forum software versions prior to 2.3.7 disclose server filesystem paths through exception messages triggered by open_basedir PHP restrictions, enabling remote unauthenticated attackers to map internal directory structures. This information disclosure vulnerability (CWE-209) affects XenForo installations and has been addressed in version 2.3.7 with vendor-confirmed security fixes. No public exploit code or active exploitation is identified at time of analysis, though the unauthenticated remote attack vector and low complexity make reconnaissance straightforward for targeted attacks.
RemediationAI
Upgrade XenForo installations to version 2.3.7 or later, which includes security fixes addressing the path disclosure issue. The vendor-released patch is available through official XenForo channels documented at https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/. Organizations should follow standard XenForo upgrade procedures including backing up the database and files before applying the update. As a temporary mitigation for installations unable to immediately upgrade, administrators may configure web server error handling to suppress detailed PHP error messages from being displayed to end users and instead log them server-side only, though this workaround does not address the underlying exception handling issue and should not replace timely patching. Review server logs for unusual patterns of error generation that might indicate active reconnaissance attempts exploiting this disclosure. Additional technical analysis is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/xenforo-path-disclosure-via-open-basedir-exceptions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits improper error handling in XenForo's PHP-based forum platform when encountering open_basedir restrictions. The open_basedir directive is a PHP security mechanism that restricts file operations to specified directories. When XenForo code attempts to access paths outside the configured allowed directories, PHP throws exceptions that inadvertently include full filesystem paths in error messages visible to remote users. This represents a classic CWE-209 (Generation of Error Message Containing Sensitive Information) weakness where verbose exception handling exposes internal implementation details. The vulnerability affects XenForo forum software (CPE 2.3:a:xenforo:xenforo) across all versions prior to 2.3.7, indicating the error handling pattern was present throughout the codebase. Such path disclosure typically occurs through web-accessible error pages or API responses that fail to sanitize exception details before presentation to end users.
Know when Xenforo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.
Executive ViewAI
XenForo forum software versions before 2.3.7 leak sensitive server filesystem paths to unauthenticated remote attackers through exception message handling, enabling reconnaissance of internal directory structures without authentication. This information disclosure directly supports follow-up targeted attacks and increases organizational exposure to secondary exploits. Any organization running XenForo forums faces immediate reputational and operational risk if internal infrastructure details are mapped by threat actors.
Apply vendor patch to XenForo version 2.3.7 or later. Interim mitigation (if patching is delayed): Implement PHP error suppression by disabling exception stack traces in error_reporting configuration and configuring web server to return generic HTTP 500 responses instead of detailed error messages to clients.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in XenForo Multiple Security Issues
View all 9Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Xenforo before 2.2.16 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authen
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code f
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored**
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertisi
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signa
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloa
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators
Exploit-DB