CVE-2026-79362 WoltLab CVE debrief

Who should care

Defenders responsible for WoltLab Suite Core installations, particularly those using versions WCF 6.1.0 to 6.1.22 and WCF 6.2.0 to 6.2.5, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-79362 is a RCE vulnerability via Cache Poisoning in WoltLab Suite Core, affecting WCF versions 6.1.0 to 6.1.22 and 6.2.0 to 6.2.5. Defenders should prioritize verifying exposure and applying vendor-provided patches or mitigations.

• Potential for arbitrary code execution
• Possible termination of nowdoc and injection of PHP code
• Verification of exposure and remediation priority
• Monitoring for suspicious activity related to cache poisoning and PHP injection

Technical summary

An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core, potentially leading to arbitrary code execution. This vulnerability affects WoltLab Suite Core versions WCF 6.1.0 to 6.1.22 and WCF 6.2.0 to 6.2.5. The injection occurs because attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code. Defenders should prioritize verifying exposure of WoltLab Suite Core installations and apply vendor-provided patches or mitigations to prevent potential code execution.

Defensive priority

Defenders should prioritize verifying exposure of WoltLab Suite Core installations, particularly versions WCF 6.1.0 to 6.1.22 and WCF 6.2.0 to 6.2.5, and apply vendor-provided patches or mitigations.

Recommended defensive actions

• Verify WoltLab Suite Core installations for exposure, particularly versions WCF 6.1.0 to 6.1.22 and WCF 6.2.0 to 6.2.5
• Apply vendor-provided patches or mitigations
• Monitor for suspicious activity related to cache poisoning and PHP injection
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Further verification is required to determine the full scope of exposure and necessary mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.