Vulnerabilities

TI-2025-43404 CVE-2025-71282 · GHSA-8fvj-rw6m-xrph

XenForo Path Disclosure via open_basedir Exceptions

MEDIUM 44

XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00348 Published 2026-04-01 Fixed in 2.3.7 CWE-209

TI-2025-43403 CVE-2025-71281 · GHSA-gvjw-m4hx-6454

MEDIUM 40

XenForo before 2.3.7 does not properly restrict methods callable from within templates.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00339 Published 2026-04-01 Fixed in 2.3.7 CWE-94

TI-2025-43402 CVE-2025-71280 · GHSA-mvm5-rv5r-322q

LOW 29

XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.0012 Published 2026-04-01 Fixed in 2.3.7 CWE-200

TI-2025-43401 CVE-2025-71279 · GHSA-gqgm-83rg-vhcj

MEDIUM 48

XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00459 Published 2026-04-01 Fixed in 2.3.7 CWE-287