Junglewise Threat Intelligence

CVE-2026-71624: esoTalk configuration comment injection leading to PHP code execution

CVE-2026-71624 · Severity: critical · CVSS 9.8 · Published 2026-09-04

Executive brief

esoTalk is a forum and community discussion platform. A vulnerability in its configuration handling allows an unauthenticated remote attacker to inject malicious PHP code through configuration comments, enabling arbitrary code execution on the server and complete compromise of the application and its data.

Technical details

The vulnerability exists in the configuration parsing logic within esoTalk v1.0.0g4, specifically in the ETMemberModel.class.php, ETMemberController.class.php, and ET.class.php components. The application fails to properly sanitize or escape user input in configuration comments, allowing an attacker to inject arbitrary PHP code. The injection occurs through the configuration file handling mechanism without requiring authentication. Successful exploitation results in arbitrary code execution with the privileges of the web server process, allowing complete system compromise. A fix or updated version should be applied immediately.

Affected products

  • esoTalk esoTalk 1.0.0g4

Timeline

  • 2026-09-04: disclosed

References