Description

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names. Attackers can craft a malicious ZIP archive with backslash path separators that bypass forward-slash validation to write arbitrary bytes to any web-server-writable path, including the public web root, achieving persistent code execution as the web-server account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-08T14:17:26.750Z",
  "pubdate": "2026-09-08T14:17:26.750Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to a critical path traversal vulnerability within the style archive importer, specifically when hosted on Windows environments.\nThe vulnerability arises from insufficient sanitization of ZIP member names, allowing authenticated users with style-related permissions to escape the intended extraction directory.\nBy leveraging backslash-based traversal sequences, an attacker can write arbitrary files to any location writable by the web server process, including the public web root.\nThis vulnerability facilitates persistent remote code execution (RCE) by enabling attackers to plant malicious scripts (such as web shells) within the application environment.\nSuccessful exploitation requires authenticated access to the XenForo administrative interface with specific permissions to import style archives.\nThe risk is categorized as high, as it allows full compromise of the web server's application layer through the manipulation of filesystem paths.",
  "technicalDetails": "The root cause of the vulnerability is an inadequate validation mechanism in the style archive importer that fails to properly normalize or sanitize file paths containing backslash characters ('\\').\nOn Windows-based deployments, the operating system treats backslashes as valid path separators. While the application's security logic may implement filters intended to block forward-slash ('/') traversal sequences (e.g., '../'), it does not account for the equivalent traversal behavior provided by backslash sequences (e.g., '..\\').\nThe attack flow begins with an authenticated user possessing style management permissions. The attacker crafts a malicious ZIP archive containing one or more entries with filenames that use backslash-based path traversal patterns to navigate outside the target directory.\nWhen the XenForo style archive importer processes these ZIP members, the application fails to resolve the path correctly or confirm that the final destination resides within the intended scope. Consequently, the archive extraction process interprets the malicious path and writes file contents to the filesystem at the destination specified by the traversal sequence.\nBecause the web server process must have write access to the target directories for the application to function, the attacker can target sensitive locations such as the web root. By uploading a malicious PHP file or equivalent server-side script, the attacker achieves arbitrary code execution under the privileges of the web server service account.\nThis impact extends to full system compromise from the perspective of the application, as the attacker can persist their access by modifying legitimate application files or creating new ones that execute on demand. The vulnerability is explicitly limited to Windows environments due to the OS-specific handling of backslashes as directory separators, a distinction that bypasses common cross-platform sanitization routines used in many PHP applications.\nExploitation is strictly authenticated, necessitating that the attacker has already obtained sufficient administrative or delegated privileges to initiate a style import operation. Once the archive is processed, the lack of path verification results in the unintended file write, bypassing standard security controls intended to limit file operations to specific subdirectories."
}