CVE-2026-74239: Windows path traversal in style imports

upload/..\..\..\style-archive-sentinel.php

XenForo rejected `../../` in imported style archives. On Windows, the same path written with backslashes escaped the extraction directory.

I imported an archive containing this entry:

```text
upload/..\..\..\style-archive-sentinel.php
```

The marker landed in the site's web root and was served as PHP.

## The other directory separator

The archive importer screened member names for forward-slash traversal. Its validation left backslashes intact, and Windows treated them as directory separators.

The test account held the delegated ACP `style` permission. Exploitation also required PHP ZIP support and a writable destination outside the temporary extraction directory. A writable web root turned the file write into code execution. Other writable locations exposed an arbitrary file write.

The [public PoC](https://github.com/BomboBombone/CVE-2026-74239) creates the archive in memory and uploads it through the normal style-import route.

XenForo fixed path handling in 2.3.13.

## Links

- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-74239)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-path-traversal-via-style-archive-importer-on-windows)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)