Description
Unspecified vulnerability in phpBB allows remote authenticated users with Administration Panel access to execute arbitrary PHP code via crafted Font Colour 3 ($theme[fontcolor3] variable) and/or signature values, possibly involving the highlight functionality. NOTE: the original report does not clarify whether this issue is static code injection, eval injection, or another type of vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | phpbb2 | 2.0.13+1-6sarge3 | DSA-1066-1 |
Advisories 1
- DSA-1066-1 phpbb2 - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20060414 phpBB Admin command execution mailing-list
- DSA-1066 vendor-advisory
- phpbb-admin-code-execution(25889) vdb-entry
- 20060418 Re: phpBB Admin command execution mailing-list
- 715 third-party-advisory
- 762 third-party-advisory
- 20093 third-party-advisory
- 20197 third-party-advisory