PT-2026-49309 · Unknown · Discuz! X5.0

Egidio Romano · Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-49954

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Discuz! X5.0 versions 20260320 through 20260610

Description An issue exists where authenticated administrators can execute arbitrary code by importing a specially crafted plugin configuration. This is achieved by including path traversal sequences in the directory attribute. By triggering an exception during plugin installation, sanitization routines are bypassed, allowing malicious paths to be stored and subsequently passed to the include() function. When combined with file upload functionality, this leads to arbitrary code execution within the context of the web server user.

Recommendations Update Discuz! X5.0 to a version released after 20260610.

Exploit

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-49954

Affected Products

Discuz! X5.0

References · 5

• 🔥 https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-49954 · Security Note
• https://karmainsecurity.com/KIS-2026-11 · Note
• https://vulncheck.com/advisories/discuz-x5-0-local-file-inclusion-via-enable-disable-php-plugin-directory · Note
• https://t.me/CVEtracker/56889 · Telegram Post