Skip to content
OpenAdvisories
High DLA-1593-1 1 CVE

phpbb3 - security update

Published Nov 24, 2018 · Updated Mar 9, 2026

Fixed packages 1

ReleasePackageFixed in
Debian · 8 phpbb3 3.0.12-5+deb8u2

Vulnerabilities 1

  • High 7.2

    phpBB Remote Code Execution

    Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.