CVE-2026-71624

CVE-2026-71624 is a code injection flaw (CWE-94) in the esoTalk forum software, version 1.0.0g4, that allows a remote attacker to execute arbitrary code. The vulnerability is reachable through the member model (core/models/ETMemberModel.class.php), the member controller (core/controllers/ETMemberController.class.php), and the core library (core/lib/ET.class.php). The CVSS vector (network vector, low complexity, no privileges or user interaction required) indicates the flaw can be triggered over the network without authentication, and the critical 9.8 score with high confidentiality, integrity, and availability impacts means successful exploitation effectively gives the attacker full control over the host running the forum. Anyone operating a forum on esoTalk 1.0.0g4 is affected. Exploitation has not yet been observed: there is no known public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a modest 0.5% probability of exploitation in the next 30 days.

What to do: Inventory your estate for esoTalk deployments, particularly instances running 1.0.0g4 with the member model, member controller, or core library exposed to untrusted network traffic. Until a patched release or vendor guidance is available, restrict internet access to any esoTalk instance and monitor for advisory updates, since no fix version is specified in the data. If you operate esoTalk in production, consider migrating to a actively maintained forum platform given the project's dormancy.