CVE-2025-71282

XenForo Path Disclosure via open_basedir Exceptions

CVSS 8.7 HIGHEPSS 0.3%CWE-209

XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

XenForo · XenForo

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.vulncheck.com/advisories/xenforo-path-disclosure-via-open-basedir-exceptions https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/