Executive brief
XenForo is a community forum software platform. A flaw in its style archive import feature on Windows allows authenticated administrators with styling permissions to write malicious code to the web server's public directory, achieving persistent code execution. An attacker with delegated style management rights can upload a specially crafted archive to take over the forum and access sensitive user data.
Technical details
XenForo's style archive importer validates ZIP member paths by rejecting forward-slash traversal sequences (/../) but fails to normalize or reject backslashes on Windows, where backslash is the path separator. An authenticated non-super administrator with style permissions can craft a malicious ZIP archive with backslash-based traversal sequences (such as upload/..\..\..\..\path\to\target) that bypass validation and write arbitrary files outside the intended extraction directory. Windows interprets these backslash sequences as directory separators during extraction, allowing the attacker to write PHP files to the web root or other writable locations. This enables persistent remote code execution as the web-server process account. The vulnerability affects XenForo versions before 2.3.13, which corrected archive-path validation logic.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: XenForo 2.3.13 released with fix