XenForo EUVD-2026-72759

Exploitation requires: (1) XenForo running on a Windows host where the OS resolves backslash as a directory separator; (2) an authenticated session as a non-super administrator account that has been granted style-import/management permissions - this is a delegated admin role, not a default low-privilege user; (3) the web-server process account must have write access to at least one directory reachable via web (e.g., the public web root). Linux and macOS deployments are immune because the OS treats backslash as a literal filename character. The requirement for a privileged (though not super-admin) authenticated account significantly raises the bar compared to fully unauthenticated vulnerabilities.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N - score 8.6) accurately captures the primary constraints: network-reachable, low attack complexity once credentials are in hand, but requiring high-privilege access (admin with style-import rights). The Windows-deployment constraint is a meaningful additional limiter not reflected in the CVSS base score, further narrowing the real-world attack surface. There is no KEV listing and no POC referenced in available intelligence, and EPSS data was not supplied. Real-world priority should be moderate-to-high for organisations running XenForo on Windows IIS or Windows+Apache stacks; for Linux deployments the risk is negligible. The primary threat model is an insider or a compromised administrator account - not opportunistic mass exploitation. The C:H/I:H/A:H impact rating is defensible because arbitrary file-write to the web root trivially yields persistent RCE as the web-server process account.

An attacker who holds - or has compromised - a XenForo non-super administrator account with style-management permissions crafts a ZIP archive containing a member named ..\..\public_html\cmd.php with embedded PHP webshell content. They upload the archive through the style importer interface; the server's forward-slash-only sanitisation passes the entry, and the Windows file-system resolves the backslash sequence to write cmd.php directly into the web root. The attacker then browses to the dropped file to obtain persistent code execution as the IIS or Apache service account. No public exploit code has been identified, but the technique is well-understood and low-complexity to implement.