Loading vulnerability…
phpBB PHAR Deserialization Leading to Remote Code Execution (Rejected CVE)
CVE-2019-25685 has been rejected or withdrawn by its CVE Numbering Authority and is not an accepted vulnerability record. The associated technical scenario describes authenticated exploitation of phpBB's plupload functionality to upload a crafted ZIP archive containing serialized PHP objects. Processing the uploaded archive through the phar:// stream wrapper, using the imagick parameter in attachment settings, can trigger unsafe deserialization and arbitrary code execution. Affected versions and the reason for rejection are not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The described exploitation could execute arbitrary PHP code in the application's execution context, potentially compromising application-accessible data, modifying application state, and disrupting service. These impacts concern the described technical scenario; the CVE identifier itself is rejected.
If you can’t patch tonight, do this now.
Until a patch can be applied, restrict or disable attachment uploads and any unnecessary plupload-exposed functionality, especially for lower-privileged authenticated users. Review and harden attachment settings involving imagick processing. Where operationally feasible, prevent application workflows from invoking phar:// on user-controlled files, and reduce the availability of dangerous gadget chains in the PHP environment. Monitor for suspicious uploaded ZIP files, unexpected PHAR usage, anomalous attachment-processing behavior, and signs of post-exploitation such as web shells or modified forum files.
Patch, then assume compromise.
Apply the vendor patch or upgrade to a phpBB version in which this issue is fixed. Because the exploit path relies on plupload handling, PHAR stream usage, and deserialization triggered through the imagick parameter in attachment settings, remediation should ensure that uploaded archives cannot be processed through phar:// in a way that triggers object deserialization, and that attachment-related image handling paths do not accept attacker-controlled PHAR content. If a patch is not yet available in the provided material, the specific fixed version is currently not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.