PT-2026-29418 · Xenforo · Xenforo

Ticktackk · CVE-2025-71282 · Published 2026-04-01 · Updated 2026-04-01

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.7

Description XenForo versions prior to 2.3.7 disclose filesystem paths through exception messages triggered by open basedir restrictions. This allows an attacker to obtain information about the server's directory structure.

Recommendations Update to version 2.3.7 or later.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2025-71282

Affected Products

Xenforo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-71282 · Security Note
• https://twitter.com/CVEnew/status/2039279702230388909 · Twitter Post
• https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121 · Vendor Advisory, Patch
• https://vulncheck.com/advisories/xenforo-path-disclosure-via-open-basedir-exceptions · Note
• https://twitter.com/CVEarity/status/2039268255492423933 · Twitter Post