CVE-2026-74239: XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names. Attackers can craft a malicious ZIP archive with backslash path separators that bypass forward-slash validation to write arbitrary bytes to any web-server-writable path, including the public web root, achieving persistent code execution as the web-server account.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects XenForo versions before 2.3.13 running on Windows. The vulnerable functionality is the style archive importer.
What level of access does an attacker need?
An attacker must be authenticated as a non-super administrator account that has style permissions. They also need to be able to supply a crafted ZIP archive to the style importer.
Are default installations exposed to unauthenticated attackers?
No unauthenticated attack path is described. Exploitation requires authenticated administrative access with style permissions, and the described traversal behavior is specific to Windows deployments.
What is the impact of successful exploitation?
An attacker can write arbitrary bytes outside the intended archive extraction directory to web-server-writable paths. Writing into the public web root can enable persistent code execution as the web-server account.
What version addresses the issue?
Upgrade XenForo to version 2.3.13 or later. Versions before 2.3.13 are identified as affected.