CVE-2026-74239 - XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

Back Back to CVE browser

HIGH

XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

Published Sep 8, 2026

8.6

HIGH

CVSS 4.0

EPSS 0.89%

Description

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names. Attackers can craft a malicious ZIP archive with backslash path separators that bypass forward-slash validation to write arbitrary bytes to any web-server-writable path, including the public web root, achieving persistent code execution as the web-server account.

Affected products

Vendor XenForo Product XenForo Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.3.13

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

XenForo

unaffected

Version	Status	Constraints
0	affected	<2.3.13

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (6)

https://bombobombone.github.io/posts/cve-2026-74239/
technical-descriptionExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72759
Advisory
https://github.com/BomboBombone/CVE-2026-74239
exploitThird Party Advisory
https://www.vulncheck.com/advisories/xenforo-path-traversal-via-style-archive-importer-on-windows
third-party-advisoryThird Party Advisory
https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
vendor-advisorypatchRelease Notes
https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
release-notesRelease Notes

Link	Providers	Tags
https://bombobombone.github.io/posts/cve-2026-74239/		technical-descriptionExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72759		Advisory
https://github.com/BomboBombone/CVE-2026-74239		exploitThird Party Advisory
https://www.vulncheck.com/advisories/xenforo-path-traversal-via-style-archive-importer-on-windows		third-party-advisoryThird Party Advisory
https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/		vendor-advisorypatchRelease Notes
https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/		release-notesRelease Notes