UpHeron
All vulnerabilities

Servers and applications

CVE-2017-17671

vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an…

Severity
Critical 9.8
Published
14 Dec 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
3% in the next 30 daysHigher than 87% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Path traversal (CWE-22)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Description

vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.

From NVD.

Affected software

SoftwareAffected versions
vBulletinServers and applications · cpe:a:vbulletin:vbulletin
  • Version 5.0.0-beta_11
  • Version 5.0.0-beta_28
  • From 5.0.1 up to 5.3.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-17671
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-17671