Vulnerability in Discuz! X5.0
CVE-2026-49954
Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to be stored unsanitized and subsequently passed to include(), which combined with file upload functionality escalates to arbitrary code execution in the context of the web server user.
EPSS: 0.005 (43.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Discuz! X5.0 — versions 20260320
Weakness classification (CWE)
References
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-49954?
- CVE-2026-49954 is a high-severity vulnerability in Discuz! X5.0, classified under PHP Remote File Inclusion. CVSS score: 7.2/10. Published 2026-06-15.
- How severe is CVE-2026-49954?
- High severity. CVSS v3 base score is 7.2 out of 10.