PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5727 Simplemachines CVE debrief

CVE-2016-5727 is a high-severity flaw in Simple Machines Forum (SMF) 2.1. NVD describes the issue as PHP object injection in LogInOut.php, with attacker-controlled variables used in a foreach loop leading to arbitrary PHP code execution. Because the attack is network-reachable and requires no privileges, internet-facing SMF 2.1 deployments should treat this as a priority fix.

Vendor
Simplemachines
Product
Simple Machines Forum
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2026-05-13
Advisory published
2017-02-09
Advisory updated
2026-05-13

Who should care

Administrators and developers responsible for Simple Machines Forum 2.1, especially teams running internet-facing forum instances or applications that embed or extend SMF login/session handling.

Technical summary

NVD maps the issue to CWE-94 and lists SMF 2.1 as vulnerable. The vulnerability description says LogInOut.php processes variables derived from user input in a foreach loop, enabling PHP object injection and potential arbitrary PHP code execution. NVD rates the issue CVSS 3.0 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Defensive priority

High. The combination of network reachability, no required privileges, and potential full confidentiality, integrity, and availability impact makes this an urgent patching and exposure-review item for affected SMF 2.1 systems.

Recommended defensive actions

  • Apply the vendor patch or upgrade path referenced in the linked SMF GitHub commit and issue record.
  • Review all SMF 2.1 deployments, prioritizing systems that are reachable from the internet.
  • Track the official CVE and NVD records for any updated remediation guidance or corrected version information.
  • Use the linked mailing-list and issue references to confirm which maintenance release or commit resolves the flaw in your deployment.

Evidence notes

Source corpus evidence is limited to the CVE record, NVD metadata, and referenced remediation discussions. The CVE description names LogInOut.php in SMF 2.1 and states that user-derived variables in a foreach loop can lead to PHP object injection and arbitrary PHP code execution. NVD assigns CWE-94 and CVSS 3.0 8.8. Reference links include Openwall OSS-security posts dated 2016-06-10 and 2016-06-18, plus GitHub issue 3522 and commit 19e560b9f3e8fc6d7d9d60c1ff617b5ed5c08008.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5727 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5727

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5727 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5727

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.