CVE-2018-19274

PoC —

CVSS 3.1

7.2 high

EPSS

5%p92

Published

Nov 17, 2018 (Nov 17, 2018)

Modified

Jun 17, 2026

Description

Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.

Vendors: phpbb debian
Products: phpbb, debian linux
Weakness: CWE-502, CWE-1321
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.2%)

In the news0 stories

No ingested article mentions this CVE yet.