EUVD-2025-209158
GHSA-8fvj-rw6m-xrph
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Description
XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.
Analysis
XenForo forum software versions prior to 2.3.7 disclose server filesystem paths through exception messages triggered by open_basedir PHP restrictions, enabling remote unauthenticated attackers to map internal directory structures. This information disclosure vulnerability (CWE-209) affects XenForo installations and has been addressed in version 2.3.7 with vendor-confirmed security fixes. No public exploit code or active exploitation is identified at time of analysis, though the unauthenticated remote attack vector and low complexity make reconnaissance straightforward for targeted attacks.
Technical Context
This vulnerability exploits improper error handling in XenForo's PHP-based forum platform when encountering open_basedir restrictions. The open_basedir directive is a PHP security mechanism that restricts file operations to specified directories. When XenForo code attempts to access paths outside the configured allowed directories, PHP throws exceptions that inadvertently include full filesystem paths in error messages visible to remote users. This represents a classic CWE-209 (Generation of Error Message Containing Sensitive Information) weakness where verbose exception handling exposes internal implementation details. The vulnerability affects XenForo forum software (CPE 2.3:a:xenforo:xenforo) across all versions prior to 2.3.7, indicating the error handling pattern was present throughout the codebase. Such path disclosure typically occurs through web-accessible error pages or API responses that fail to sanitize exception details before presentation to end users.
Affected Products
This vulnerability affects XenForo forum software in all versions prior to 2.3.7. XenForo is a commercial PHP-based forum platform widely deployed for community discussion websites. The affected product is identified by CPE 2.3:a:xenforo:xenforo with version ranges spanning from earliest releases through 2.3.6. Organizations running XenForo installations should verify their deployed version against this threshold, particularly internet-facing community forums where anonymous users can trigger error conditions. The vendor has acknowledged this as a security issue in their official release announcement at https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/.
Remediation
Upgrade XenForo installations to version 2.3.7 or later, which includes security fixes addressing the path disclosure issue. The vendor-released patch is available through official XenForo channels documented at https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/. Organizations should follow standard XenForo upgrade procedures including backing up the database and files before applying the update. As a temporary mitigation for installations unable to immediately upgrade, administrators may configure web server error handling to suppress detailed PHP error messages from being displayed to end users and instead log them server-side only, though this workaround does not address the underlying exception handling issue and should not replace timely patching. Review server logs for unusual patterns of error generation that might indicate active reconnaissance attempts exploiting this disclosure. Additional technical analysis is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/xenforo-path-disclosure-via-open-basedir-exceptions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today