PT-2026-7178 · Smarty+1 · Smarty+1

Matrix-Cain · Published 2026-02-09 · Updated 2026-02-09 · CVE-2026-25923

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions my little forum versions prior to 20260208.1

Description The application does not properly filter the phar:// protocol in URL validation. This allows attackers to upload a malicious Phar Polyglot file, disguised as a JPEG, through the image upload feature. The application then triggers Phar deserialization through BBCode [img] tag processing and exploits a Smarty 4.1.0 Property-Oriented Programming (POP) chain, leading to arbitrary file deletion. The vulnerable component is the image upload feature, which processes BBCode tags. The API endpoint involved is the image upload functionality. The vulnerable parameter is the image file itself.

Recommendations Update my little forum to version 20260208.1 or later.

Exploit

Fix

Deserialization of Untrusted Data

Unrestricted File Upload

Weakness Enumeration

CWE-502

CWE-434

Related Identifiers

CVE-2026-25923

GHSA-WR9P-3C3G-78FW

Affected Products

Smarty

My Little Forum

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25923.json · Exploit
• https://github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-wr9p-3c3g-78fw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25923 · Security Note
• https://github.com/My-Little-Forum/mylittleforum/releases/tag/20260208.1 · Note
• https://t.me/CVEtracker/44238 · Telegram Post