CVE-2026-49954 Details

A local file inclusion vulnerability has been identified in Discuz! X5.0, specifically in releases from 20260320 to 20260610. This vulnerability allows authenticated administrators to execute arbitrary code by importing a malicious plugin configuration that includes path traversal sequences in the directory attribute. The issue arises because the application fails to properly sanitize the plugin metadata before it is processed. Exploitation of this vulnerability involves triggering an exception during the plugin installation, which bypasses the sanitization routines and allows malicious paths to be stored and later included via the PHP include() function. When combined with the application's file upload functionality, this vulnerability can be escalated to arbitrary code execution on the server, with the executed code running in the context of the web server user.