CVE-2026-74239

CVE-2026-74239 is a path traversal flaw (CWE-22) in XenForo's style archive importer that affects XenForo versions before 2.3.13 when running on Windows. An authenticated account with style-management permissions (no super-administrator or super-user rights required) can upload a crafted ZIP archive whose member names use backslash path separators, bypassing the importer's forward-slash validation and traversal checks. Because backslash-based sequences such as '..\' escape the intended extraction directory, the attacker can write arbitrary bytes to any path writable by the web server, including the public web root. By dropping a persistent file (such as a script) into the web root, the attacker achieves code execution as the web-server account that survives the original session. Exploitation has not been confirmed in the wild: the flaw is not in CISA KEV, EPSS currently estimates a 0.7% chance of exploitation within 30 days, and one public proof-of-concept reference exists on GitHub.

What to do: Upgrade XenForo to 2.3.13 or later, prioritizing Windows-hosted instances. Until patched, limit style archive import/creation permissions to fully trusted staff and treat uploaded style archives from other administrators with suspicion. On Windows hosts, review web-server-writable directories (especially the web root and its subdirectories) for recently created or modified unexpected files, which would indicate attempted exploitation.