Path Traversal in Ubb Systems Ubb.threads

CVE-2026-54223

UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server that application has privileges to, what results in Remote Code Execution.  Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

Vulnerability class: Path Traversal (Directory Traversal)

Published · last modified .

EPSS exploit prediction

EPSS: 0.008 (54.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-54223: held from 0.006 to 0.008.

EPSS over last 30 days · oldest: 0.006 · newest: 0.008 · change: +0.001

Affected products

Weakness classification (CWE)

References