CVE-2017-17671

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-12-14 · updated 2026-06-17
Weakness: CWE-22

Description

vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.

Affected products

vBulletin: from 5.0.1 through 5.3.3; 5.0.0-beta_11, 5.0.0-beta_28

References

https://blogs.securiteam.com/index.php/archives/3569
https://blogs.securiteam.com/index.php/archives/3569

Get alerted when CVE-2017-17671 or the next vulnerability affects your stack