CVE-2025-71282 HIGH

CVE-2025-71282: XenForo Path Disclosure via open_basedir Exceptions

Vendor Xenforo

Product XenForo

Weakness CWE-209 · Error message info leak

Published April 1, 2026

Last update April 1, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.

Key dates

02Disclosure timeline

April 1, 2026 CVE published

April 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-71282 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/209.html

Related vulnerabilities

CVE-2025-71282: XenForo Path Disclosure via open_basedir Exceptions

01Description

02Disclosure timeline

03References

04Related CVE