bombobombone/cve-2026-74239Proof of concept and technical write-up for CVE-2026-74239, a path traversal vulnerability in XenForo style archive imports on Windows, allowing file write via crafted ZIP.
XenForo before 2.3.13 is vulnerable to path traversal in style archive imports on Windows.
The importer accepts ZIP members under upload/ and rejects names containing the forward-slash form /../. It does not normalize or reject backslashes. XenForo then appends the retained member name to its temporary extraction directory. Windows interprets ..\ as parent-directory traversal.
A non-super ACP administrator with the style permission can escape the temporary directory and write bytes to another web-server-writable path. On XenForo 2.3.12 (build 2031270), a crafted member wrote a new PHP marker file into the public web root; requesting it executed the constant marker as the web-server account.
The prerequisites are a Windows deployment with PHP ZIP support, a delegated style administrator, and a writable destination. XenForo 2.3.13 contains the fix.
python poc.py https://xenforo.example LIMITED_STYLE_ADMIN --confirm-write
The password is read from a prompt. The script creates style-archive-sentinel.php and prints its path after the run.
Discovered by Marco Paciaroni (BomboBombone).