-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using file_exists with untrusted absolute paths in configuration handling. The security advisory specifically mentions removing ImageMagick path configuration as the fix, indicating the path was being passed to file_exists without proper validation. This allowed Phar deserialization when a malicious path was provided, as PHP's file_exists automatically parses Phar metadata. The function's presence in configuration validation logic (likely in ACP board settings handlers) made it the attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpbb/phpbb | composer | < 3.2.4 | 3.2.4 |