CVE-2026-79362 WoltLab CVE debrief

Who should care

Defenders responsible for WoltLab Suite Core installations, particularly those with low-privileged user accounts, should assess exposure and prioritize patching. This includes reviewing the inventory of WoltLab Suite Core installations and their versions, as well as verifying the affected scope and severity through official advisories and CVE records. Additionally, defenders should review compensating controls for exposed systems and monitor relevant logs.

Why it matters

CVE-2026-79362 is a high-severity RCE vulnerability in WoltLab Suite Core, allowing low-privileged users to inject PHP code via cache poisoning. Defenders should prioritize patching and assess exposure for low-privileged users.

• Potential code execution by low-privileged users
• Cache poisoning vulnerability requires patching
• Verification of WoltLab Suite Core inventory and versions
• Potential impact on systems with low-privileged user accounts

Technical summary

An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core, allowing for arbitrary PHP code execution. This vulnerability is caused by the improper handling of attacker-controlled data, which can terminate the nowdoc prematurely and inject arbitrary PHP Code. The affected products include WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. Defenders should prioritize patching these versions and assess exposure for low-privileged users to prevent potential code execution.

Defensive priority

Defenders should prioritize patching WoltLab Suite Core versions 6.1.0 to 6.1.22 and 6.2.0 to 6.2.5, and assess exposure for low-privileged users.

Recommended defensive actions

• Patch WoltLab Suite Core to version 6.1.23 or later
• Patch WoltLab Suite Core to version 6.2.6 or later
• Assess exposure for low-privileged users
• Verify inventory of WoltLab Suite Core installations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and a CVSS score of 8.8. Source references include GitHub commit and community update threads. The vulnerability has been assessed as high-severity, with a CVSS score of 8.8, indicating a significant risk to affected systems. Defenders should verify the affected scope and severity through official advisories and CVE records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.