PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49954 Discuz! CVE debrief

CVE-2026-49954 is a HIGH severity vulnerability in Discuz! X5.0 that allows authenticated administrators to execute arbitrary code via a local file inclusion (LFI) vulnerability. The vulnerability affects Discuz! X5.0 releases from 20260320 through 20260610. Attackers can exploit this vulnerability by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute, which can trigger an exception during plugin installation and bypass sanitization routines. This can cause malicious paths to be stored unsanitized and subsequently passed to include(), leading to arbitrary code execution in the context of the web server user.

Vendor
Discuz!
Product
Discuz! X5.0
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-16
Advisory published
2026-06-15
Advisory updated
2026-06-16

Who should care

Administrators and users of Discuz! X5.0, especially those with administrative privileges, should be aware of this vulnerability and take immediate action to mitigate the risk.

Technical summary

The vulnerability is caused by a local file inclusion (LFI) vulnerability in Discuz! X5.0 that allows authenticated administrators to execute arbitrary code. The vulnerability is triggered by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute.

Defensive priority

HIGH

Recommended defensive actions

  • Update Discuz! X5.0 to a version outside of the affected range (20260320 through 20260610).
  • Restrict access to the plugin configuration and directory attributes to prevent unauthorized modifications.
  • Implement additional security measures, such as input validation and sanitization, to prevent similar vulnerabilities.

Evidence notes

The vulnerability was reported by Karmainsecurity and documented in the NVD database.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49954 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49954

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49954 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49954

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.