Which versions of UBB.threads are affected by EUVD-2026-37886?

UBB.threads forum software version 7.7.5 contains a remote code execution vulnerability affecting administrators with template-edit privileges, enabling unauthorized file manipulation and potential…

How to fix or mitigate EUVD-2026-37886?

Within 24 hours: Inventory all systems running UBB.threads 7.7.5 and audit all user accounts with template-edit privileges; immediately review administrative logs for unauthorized file operations. Within 7 days: Restrict template-edit privileges to essential personnel only, implement enhanced monitoring of administrative actions, and enforce multi-factor authentication on all privileged accounts. Within 30 days: Monitor vendor advisories for future patch availability; evaluate migration to alternative forum software; implement file integrity monitoring on application directories as interim protection.

UBB.threads EUVD-2026-37886

Q: What is the CVSS score of EUVD-2026-37886?

EUVD-2026-37886 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-54223 HIGH

Path Traversal (CWE-22)

2026-06-18 CERT-PL

GHSA-jgf8-gg7j-fq24

RCE Path Traversal Ubb Threads Ubb Systems

8.6

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable admin UI (AV:N/AC:L), template-edit privilege required (PR:H), no user interaction (UI:N); arbitrary file R/W escapes the application's intended file scope so S:C, and RCE yields full C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 13:32 vuln.today

DescriptionCVE.org

UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server that application has privileges to, what results in Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

AnalysisAI

Remote code execution in UBB.threads forum software (version 7.7.5 confirmed) is achievable by authenticated users holding template-edit privileges, who can abuse a path traversal weakness to read and write arbitrary files within the web application's privilege scope. CERT-PL reported the issue after vendor contact attempts failed, and there is no public exploit identified at time of analysis. The flaw escalates a routine administrative capability into full server compromise without requiring user interaction.

Technical ContextAI

UBB.threads is a long-running PHP-based bulletin-board / community forum platform produced by UBB Systems (CPE cpe:2.3:a:ubb_systems:ubb.threads:*). The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal'), meaning user-supplied input identifying a template file is not properly canonicalized or constrained to the intended template directory, so sequences like '../' or absolute paths are honored. Because the template editor must by design read and write files on disk to persist customizations, the missing boundary check converts that legitimate file I/O primitive into arbitrary read/write across whatever the PHP/web server process can access, and writing executable content (a PHP web shell or a poisoned template) yields code execution under the web server user.

RemediationAI

No vendor-released patch identified at time of analysis - CERT-PL reports that vendor contact attempts were unsuccessful, so operators must rely on compensating controls until UBB Systems publishes a fix. Practical mitigations: restrict the 'edit templates' permission to the absolute minimum number of trusted administrator accounts and require strong, unique credentials plus MFA on those accounts to make PR:H harder to satisfy (trade-off: limits delegated theme/community management); place the forum behind authenticated VPN or IP allow-listing for the /admin and template-editor endpoints (trade-off: breaks remote admin from arbitrary networks); deploy a WAF rule blocking '../' sequences, encoded traversal ('%2e%2e', '..%2f') and absolute paths in template-editor parameters (trade-off: may false-positive on legitimate template names); enforce filesystem-level hardening so the PHP/web user has read-only access to application code and no write access outside an isolated template directory (trade-off: legitimate template saves will need that directory writable); monitor template directories and webroot for new or modified .php files. Track the CERT-PL advisory at https://cert.pl/en/posts/2026/06/CVE-2026-54219 and the vendor site https://www.ubbcentral.com/ for an eventual patched release.