GCVE-1988-2026-0344

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Discuz!",
          "vendor": "Discuz!",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----------------------------------------------------------------------\nDiscuz! <= X5.0 (enable_disable.php) Local File Inclusion Vulnerability\n-----------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.discuz.vip\n\n\n[-] Affected Versions:\n\nVersion X5.0, releases 20260320 through 20260610.\nOlder X3.4 and X3.5 releases may be affected too.\n\n\n[-] Vulnerability Description:\n\nA Local File Inclusion (LFI) vulnerability exists in the Discuz! plugin\nmanagement functionality. When enabling or disabling a plugin, the\napplication includes a file whose path is derived from plugin metadata\nstored in the database. Due to insufficient validation of the plugin's\ndirectory attribute during the import process, an administrator can import\na specially crafted plugin configuration containing Directory Traversal\nsequences. By additionally triggering an exception during plugin\ninstallation, the sanitization routine can be bypassed, causing malicious\npaths to be stored unsanitized.\n\nThe vulnerable code is located in the\n/source/app/admin/child/plugins/enable_disable.php script:\n\n32 if(!empty($pluginarray[$operation.'file']) && preg_match('/^[\\w\\.]+$/',\n$pluginarray[$operation.'file'])) {\n33 $filename = DISCUZ_PLUGIN($dir).'/'.$pluginarray[$operation.'file'];\n34 if(file_exists($filename)) {\n35 $installlang = load_installlang($dir);\n36 @include $filename;\n37 }\n38 }\n\nBecause the attacker controls both the plugin directory and the included\nfilename through the imported plugin metadata, it becomes possible to force\nthe application to include arbitrary files from the local filesystem by\nabusing the include() call at line 36. By combining this issue with an\nupload functionality that allows PHP code to be stored on the server, an\nauthenticated administrator can escalate the vulnerability to arbitrary PHP\ncode execution, resulting in Remote Code Execution (RCE) in the context of\nthe web server user.\n\nSuccessful exploitation of this vulnerability requires administrator\nprivileges.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/discuz_rce.zip\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[27/04/2026] - Vendor contacted through private messages on gitee.com, no\nresponse\n[27/04/2026] - Vendor contacted via e-mail at admin () discuz vip and\nsecurity () tencent com, no response\n[07/05/2026] - Opened issue IJLFUW on https://gitee.com/Discuz/DiscuzX\n[09/05/2026] - Vulnerability details shared within issue IJLFUW\n[09/05/2026] - Vendor replied \"all plugin-related issues are reviewed by\napplication center auditors\"\n[09/06/2026] - CVE identifier requested\n[09/06/2026] - CVE identifier assigned\n[13/06/2026] - Public disclosure at hackmeeting 0x1D\n[15/06/2026] - Publication of this advisory\n\n\n[-] CVE Reference:\n\nCVE-2026-49954 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-11\n\n\n[-] Technical write-up:\n\nhttps://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/5"
        },
        {
          "url": "https://gitee.com/Discuz/DiscuzX"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-11"
        },
        {
          "url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
        },
        {
          "url": "https://karmainsecurity.com/pocs/discuz_rce.zip"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.discuz.vip"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-11] Discuz! <= X5.0 (enable_disable.php) Local File Inclusion Vulnerability",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-49954",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0344",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/5",
            "automated": true,
            "contentSha256": "b27975a4c6b5b4d9cfc4df6cac3cf19509001218a032a1e245c6b263c15b8a72",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-15T18:44:33Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:57Z",
    "dateUpdated": "2026-09-11T07:55:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0344"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}