Vulnerability in Discuz! X5.0
CVE-2026-49954
Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to be stored unsanitized and subsequently passed to include(), which combined with file upload functionality escalates to arbitrary code execution in the context of the web server user.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (44.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 44.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.005 · change: -0.002
Affected products
- Discuz! X5.0 — versions 20260320
Weakness classification (CWE)
References
- karmainsecurity.com/KIS-2026-11 (technical-description)
- karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce (exploit)
- www.vulncheck.com/advisories/discuz-x5-0-local-file-inclusion-via-enable-disabl… (third-party-advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-49954?
- CVE-2026-49954 is a high-severity vulnerability in Discuz! X5.0, classified under PHP Remote File Inclusion. CVSS score: 7.2/10. Published 2026-06-15.
- How severe is CVE-2026-49954?
- High severity. CVSS v3 base score is 7.2 out of 10.