PT-2026-29418 · Xenforo · Xenforo

Ticktackk · Published 2026-04-01 · Updated 2026-04-01 · CVE-2025-71282

NVD

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open basedir restrictions. This allows an attacker to obtain information about the server's directory structure.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2025-71282

Affected Products

Xenforo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-71282 · Security Note
• https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121 · Vendor Advisory
• https://vulncheck.com/advisories/xenforo-path-disclosure-via-open-basedir-exceptions · Note