CyberRota Analysis
AI-GeneratedXenForo versions prior to 2.3.13 on Windows are vulnerable to a path traversal flaw that enables authenticated non-super administrators with style permissions to exploit ZIP archives. By using backslash-based traversal sequences, attackers can write arbitrary files outside the intended directory, potentially leading to persistent code execution on the web server. Organizations using XenForo should prioritize patching this vulnerability to mitigate the risk of unauthorized file manipulation and execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names. Attackers can craft a malicious ZIP archive with backslash path separators that bypass forward-slash validation to write arbitrary bytes to any web-server-writable path, including the public web root, achieving persistent code execution as the web-server account.
Related CVEs
Other vulnerabilities affecting the same vendor(s)