EUVD-2025-209158
GHSA-8fvj-rw6m-xrph
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.
AnalysisAI
XenForo forum software versions prior to 2.3.7 disclose server filesystem paths through exception messages triggered by open_basedir PHP restrictions, enabling remote unauthenticated attackers to map internal directory structures. This information disclosure vulnerability (CWE-209) affects XenForo installations and has been addressed in version 2.3.7 with vendor-confirmed security fixes. No public exploit code or active exploitation is identified at time of analysis, though the unauthenticated remote attack vector and low complexity make reconnaissance straightforward for targeted attacks.
Technical ContextAI
This vulnerability exploits improper error handling in XenForo's PHP-based forum platform when encountering open_basedir restrictions. The open_basedir directive is a PHP security mechanism that restricts file operations to specified directories. When XenForo code attempts to access paths outside the configured allowed directories, PHP throws exceptions that inadvertently include full filesystem paths in error messages visible to remote users. This represents a classic CWE-209 (Generation of Error Message Containing Sensitive Information) weakness where verbose exception handling exposes internal implementation details. The vulnerability affects XenForo forum software (CPE 2.3:a:xenforo:xenforo) across all versions prior to 2.3.7, indicating the error handling pattern was present throughout the codebase. Such path disclosure typically occurs through web-accessible error pages or API responses that fail to sanitize exception details before presentation to end users.
RemediationAI
Upgrade XenForo installations to version 2.3.7 or later, which includes security fixes addressing the path disclosure issue. The vendor-released patch is available through official XenForo channels documented at https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/. Organizations should follow standard XenForo upgrade procedures including backing up the database and files before applying the update. As a temporary mitigation for installations unable to immediately upgrade, administrators may configure web server error handling to suppress detailed PHP error messages from being displayed to end users and instead log them server-side only, though this workaround does not address the underlying exception handling issue and should not replace timely patching. Review server logs for unusual patterns of error generation that might indicate active reconnaissance attempts exploiting this disclosure. Additional technical analysis is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/xenforo-path-disclosure-via-open-basedir-exceptions.
Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Xenforo before 2.2.16 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authen
Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unaut
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code f
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored**
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertisi
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signa
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloa
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators
Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through
OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to req
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today