CVE-2018-19274

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-11-17 · updated 2026-06-17
Weakness: CWE-502

Description

Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.

Affected products

Debian Linux: 8.0
phpBB: before 3.2.4 — fixed in 3.2.4

How to fix

Upgrade to a fixed version: phpBB 3.2.4. Check the vendor advisory for mitigations.

References

https://blog.ripstech.com/2018/phpbb3-phar-deserialization-to-remote-code-execution/
https://lists.debian.org/debian-lts-announce/2018/11/msg00029.html
https://www.phpbb.com/community/viewtopic.php?f=14&t=2492206
https://blog.ripstech.com/2018/phpbb3-phar-deserialization-to-remote-code-execution/
https://lists.debian.org/debian-lts-announce/2018/11/msg00029.html
https://www.phpbb.com/community/viewtopic.php?f=14&t=2492206

Get alerted when CVE-2018-19274 or the next vulnerability affects your stack