What’s Vulnerable › Vulnerabilities

CVE-2026-74239: XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-08 · updated 2026-09-11
• Weakness: CWE-22

Description

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names. Attackers can craft a malicious ZIP archive with backslash path separators that bypass forward-slash validation to write arbitrary bytes to any web-server-writable path, including the public web root, achieving persistent code execution as the web-server account.

Affected products

• XenForo: before 2.3.13 — fixed in 2.3.13

How to fix

Upgrade to a fixed version: XenForo 2.3.13. Check the vendor advisory for mitigations.

References

• https://bombobombone.github.io/posts/cve-2026-74239/
• https://github.com/BomboBombone/CVE-2026-74239
• https://www.vulncheck.com/advisories/xenforo-path-traversal-via-style-archive-importer-on-windows
• https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
• https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/

Get alerted when CVE-2026-74239 or the next vulnerability affects your stack