CVE-2024-25006

—

CVSS 3.1

8.1 high

EPSS

1%p61

Published

Feb 29, 2024 (Feb 29, 2024)

Modified

Jun 17, 2026

Description

XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import.

Vendors: xenforo
Products: xenforo
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.