PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5727 Simplemachines CVE debrief

CVE-2016-5727 is a high-severity flaw in Simple Machines Forum (SMF) 2.1. NVD describes the issue as PHP object injection in LogInOut.php, with attacker-controlled variables used in a foreach loop leading to arbitrary PHP code execution. Because the attack is network-reachable and requires no privileges, internet-facing SMF 2.1 deployments should treat this as a priority fix.

Vendor
Simplemachines
Product
CVE-2016-5727
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2026-05-13
Advisory published
2017-02-09
Advisory updated
2026-05-13

Who should care

Administrators and developers responsible for Simple Machines Forum 2.1, especially teams running internet-facing forum instances or applications that embed or extend SMF login/session handling.

Technical summary

NVD maps the issue to CWE-94 and lists SMF 2.1 as vulnerable. The vulnerability description says LogInOut.php processes variables derived from user input in a foreach loop, enabling PHP object injection and potential arbitrary PHP code execution. NVD rates the issue CVSS 3.0 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Defensive priority

High. The combination of network reachability, no required privileges, and potential full confidentiality, integrity, and availability impact makes this an urgent patching and exposure-review item for affected SMF 2.1 systems.

Recommended defensive actions

  • Apply the vendor patch or upgrade path referenced in the linked SMF GitHub commit and issue record.
  • Review all SMF 2.1 deployments, prioritizing systems that are reachable from the internet.
  • Track the official CVE and NVD records for any updated remediation guidance or corrected version information.
  • Use the linked mailing-list and issue references to confirm which maintenance release or commit resolves the flaw in your deployment.

Evidence notes

Source corpus evidence is limited to the CVE record, NVD metadata, and referenced remediation discussions. The CVE description names LogInOut.php in SMF 2.1 and states that user-derived variables in a foreach loop can lead to PHP object injection and arbitrary PHP code execution. NVD assigns CWE-94 and CVSS 3.0 8.8. Reference links include Openwall OSS-security posts dated 2016-06-10 and 2016-06-18, plus GitHub issue 3522 and commit 19e560b9f3e8fc6d7d9d60c1ff617b5ed5c08008.

Official resources

The CVE was published on 2017-02-09. NVD references include June 2016 mailing-list and patch discussions, indicating the issue was publicly discussed before CVE publication. This debrief uses the CVE published date for timing context.