bombobombone/cve-2026-74239Proof of concept and technical write-up for CVE-2026-74239, a path traversal vulnerability in XenForo style archive imports on Windows, allowing file write via crafted ZIP.
XenForo before 2.3.13 is vulnerable to path traversal in style archive imports on Windows.
The importer accepts ZIP members under upload/ and rejects names containing the forward-slash form /../. It does not normalize or reject backslashes. XenForo then appends the retained member name to its temporary extraction directory. Windows interprets ..\ as parent-directory traversal.
A non-super ACP administrator with the style permission can escape the temporary directory and write bytes to another web-server-writable path. In my XenForo 2.3.12 (build 2031270) test installation, a crafted member wrote a new PHP marker file into the public web root; requesting it executed the constant marker as the web-server account.
The prerequisite is a Windows deployment with PHP ZIP support and a delegated style administrator. The proof uses a fixed new filename, refuses to overwrite an existing file, and contains no command execution. XenForo 2.3.13 contains the fix.
python poc.py https://xenforo.example LIMITED_STYLE_ADMIN --confirm-write
The password is read with a hidden prompt. Remove style-archive-sentinel.php from the test web root immediately after the run.
Discovered by Marco Paciaroni (BomboBombone).