Read the docs
TI-2026-52026 Aliases CVE-2026-74239GHSA-fxw8-p3x8-7xqx

XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

Priority MEDIUM 41CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names. Attackers can craft a malicious ZIP archive with backslash path separators that bypass forward-slash validation to write arbitrary bytes to any web-server-writable path, including the public web root, achieving persistent code execution as the web-server account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00887 59th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed XenForo (XenForo): 2.3.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XenForoXenForobefore 2.3.132.3.13Patch availableCNA
  • XenForo VendorXenForo Affected before 2.3.13 Fixed in 2.3.13 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*before 2.3.13VulnerableXenForo
  • cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:* Versions before 2.3.13 Vulnerable ·XenForo

Remediation

  • Fix · CNA XenForo (XenForo) Fixed in 2.3.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    XenForo — xenforo.com/community/threads/security-fixes-released-for-a…

    14 records Highest priority Priority HIGH 4 HIGH, 5 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-51441 XenForo < 2.3.13 Payment Replay via PayPal REST Payment ProviderPriority HIGH 77
    • TI-2026-51439 XenForo < 2.3.13 Signature Verification Bypass via PayPal REST WebhookPriority HIGH 77
    • TI-2026-51436 XenForo < 2.3.13 OAuth2 Authorization Code ReusePriority HIGH 74
    Show all 14 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-74239
  2. 2026-10-03 Alias added: GHSA-fxw8-p3x8-7xqx

References

Exploit 2

Patch 1

Other 1

  • TI-2026-51441 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider CVSS 4.0HIGH 8.7
  • TI-2026-51439 XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook CVSS 4.0HIGH 8.7
  • TI-2026-51436 XenForo < 2.3.13 OAuth2 Authorization Code Reuse CVSS 4.0CRITICAL 9.1
  • TI-2026-51434 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint CVSS 4.0CRITICAL 9.1
  • TI-2024-25701 Xenforo before 2.2.16 allows code injection. CVSS 3.1HIGH 8.8
  • TI-2026-51446 XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser CVSS 4.0HIGH 7.1
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences