PT-2026-7178 · Smarty+1 · Smarty+1

Matrix-Cain · Publicado 2026-02-09 · Atualizado 2026-02-09 · CVE-2026-25923

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions my little forum versions prior to 20260208.1

Description The application does not properly filter the phar:// protocol in URL validation. This allows attackers to upload a malicious Phar Polyglot file, disguised as a JPEG, through the image upload feature. The application then triggers Phar deserialization through BBCode [img] tag processing and exploits a Smarty 4.1.0 Property-Oriented Programming (POP) chain, leading to arbitrary file deletion. The vulnerable component is the image upload feature, which processes BBCode tags. The API endpoint involved is the image upload functionality. The vulnerable parameter is the image file itself.

Recommendations Update my little forum to version 20260208.1 or later.

Exploit

Correção

Deserialization of Untrusted Data

Unrestricted File Upload

Enumeração de Fraquezas

CWE-502

CWE-434

Identificadores relacionados

CVE-2026-25923

GHSA-WR9P-3C3G-78FW

Produtos afetados

Smarty

My Little Forum

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25923.json · Exploit
• https://github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-wr9p-3c3g-78fw · Aviso do Fabricante
• https://github.com/My-Little-Forum/mylittleforum/releases/tag/20260208.1 · Nota
• https://osv.dev/vulnerability/CVE-2026-25923 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25923 · Nota de Segurança
• https://t.me/CVEtracker/44238 · Publicação no Telegram