Read the docs
TI-2026-20953 Aliases CVE-2026-25923

Phar Deserialization leading to Arbitrary File Deletion in my little forum

Priority HIGH 77CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to 20260208.1, the application fails to filter the phar:// protocol in URL validation, allowing attackers to upload a malicious Phar Polyglot file (disguised as JPEG) via the image upload feature, trigger Phar deserialization through BBCode [img] tag processing, and exploit Smarty 4.1.0 POP chain to achieve arbitrary file deletion. This vulnerability is fixed in 20260208.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00493 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed mylittleforum (My-Little-Forum): 20260208.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
My-Little-Forummylittleforumbefore 20260208.120260208.1Patch availableCNA
  • mylittleforum VendorMy-Little-Forum Affected before 20260208.1 Fixed in 20260208.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mylittleforum:my_little_forum:*:*:*:*:*:*:*:*before 20260208.1VulnerableMylittleforum
  • cpe:2.3:a:mylittleforum:my_little_forum:*:*:*:*:*:*:*:* Versions before 20260208.1 Vulnerable ·Mylittleforum

Remediation

  • Fix · CNA mylittleforum (My-Little-Forum) Fixed in 20260208.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25923
  2. 2026-10-07 EPSS moved to the 50th–90th percentile
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Other 1

  • TI-2025-38821 my little forum vulnerable to SQL Injection in Bookmark Reordering via bookmarks parameter CVSS 3.1HIGH 8.8
  • TI-2008-04628 Cross-site scripting (XSS) vulnerability in My Little Forum 1.75 and 2.0 Beta 23 allows… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences