CVE-2026-25923 Details
Description
my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to 20260208.1, the application fails to filter the phar:// protocol in URL validation, allowing attackers to upload a malicious Phar Polyglot file (disguised as JPEG) via the image upload feature, trigger Phar deserialization through BBCode [img] tag processing, and exploit Smarty 4.1.0 POP chain to achieve arbitrary file deletion. This vulnerability is fixed in 20260208.1.
A vulnerability in My Little Forum versions prior to 20260208.1 allows for Phar deserialization exploitation, leading to arbitrary file deletion. The issue arises from inadequate URL validation in the image upload feature, where the phar:// protocol is not properly filtered. This oversight enables attackers to upload a malicious Phar file disguised as a JPEG image, which is then processed through BBCode image tags. The vulnerability takes advantage of a deserialization flaw in Smarty 4.1.0, executing a chain of operations that results in the deletion of specified files.
Users can upgrade to My Little Forum version 20260208.1, where this vulnerability has been fixed. For those unable to upgrade, it's recommended to disable the image upload feature or implement server-level restrictions to prevent the phar:// protocol from being used.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/My-Little-Forum/mylittleforum/releases/tag/20260208.1 | [email protected] | ProductRelease Notes |
| https://github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-wr9p-3c3g-78fw | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mylittleforum my little forum | < 20260208.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Feb 9, 2026 | New CVE Received | [email protected] |