PHP Object Injection Vulnerability in Monero Forum Software

CVE-2025-34060

What is CVE-2025-34060?

The Monero Project’s Laravel-based forum software suffers from a PHP object injection vulnerability due to improper handling of untrusted input in the /get/image/ endpoint. This flaw allows an attacker to manipulate user-supplied link parameters and pass them directly to the file_get_contents() function without adequate sanitization. By exploiting crafted stream filter chains, an attacker can bypass MIME type checks and gain access to sensitive internal Laravel configuration files. Consequently, a malicious user can extract critical application keys and forge encrypted cookies, potentially leading to unauthorized execution of commands and control of the server.

References