Loading vulnerability…
XenForo open_basedir exception path disclosure
CVE-2025-71282 is an information disclosure vulnerability affecting XenForo versions before 2.3.7. Under conditions where PHP open_basedir restrictions are triggered, XenForo exposes filesystem paths in exception messages. This results in disclosure of internal server path information and directory structure details to an unauthenticated remote attacker. Based on the provided context, the issue is an error-message information exposure condition rather than a memory corruption or code execution flaw.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to learn sensitive filesystem path information and aspects of the server's directory layout. This can aid reconnaissance, improve the reliability of follow-on attacks, and help identify application locations, deployment structure, or other environmental details. The provided context indicates confidentiality impact only, with no stated integrity or availability impact.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure of verbose exception output to remote users and review application and web-server error handling so internal paths are not returned in responses. Because the issue is specifically triggered by open_basedir-related exceptions, administrators should also review PHP open_basedir behavior and ensure production systems do not expose raw exception details. However, the primary remediation is upgrading to XenForo 2.3.7 or later.
Patch, then assume compromise.
Upgrade XenForo to version 2.3.7 or later. The provided references indicate that XenForo 2.3.7 includes the security fix for this issue.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.