Path Traversal Vulnerability in XenForo Product on Windows Deployments

CVE-2026-74239

What is CVE-2026-74239?

XenForo versions prior to 2.3.13 are susceptible to a path traversal vulnerability in the style archive importer on Windows platforms. This flaw allows authenticated users lacking super administrator privileges to manipulate style permissions, effectively writing arbitrary files outside the designated extraction directory. By utilizing backslash-based traversal sequences in ZIP member names, attackers can create malicious ZIP archives that circumvent validation checks. This vulnerability enables the potential for unauthorized file writing to any web-server-writable location, including sensitive areas like the public web root, which can lead to persistent code execution on the web server.

References