XenForo 2.3.12 build 2031270 did not treat backslashes as path separators when validating filenames in imported style archives. On Windows, an ACP administrator with the delegated style permission could write an archive member outside the temporary extraction directory.
Technical details
The importer rejected forward-slash traversal sequences but left backslashes unchanged. Windows interpreted those backslashes as directory separators during extraction.
An archive member can use a path such as:
upload/..\..\..\style-archive-sentinel.php
Reproduction
- Run XenForo on Windows with PHP ZIP support enabled.
- Use an ACP account with the delegated
style permission.
- Create a style archive containing the traversal member shown above.
- Import the archive through the normal style-import action.
- Request
/style-archive-sentinel.php from the web server.
The importer wrote the archive member into the web root, where the web server executed it as PHP.
Impact
A delegated style administrator could write files to locations writable by the web-server process. If the web root is writable, the uploaded PHP file can execute when requested; otherwise, writes remain limited to the process’s filesystem permissions.
XenForo corrected archive-path validation in 2.3.13.
References
XenForo 2.3.12 build 2031270 did not treat backslashes as path separators when validating filenames in imported style archives. On Windows, an ACP administrator with the delegated `style` permission could write an archive member outside the temporary extraction directory.
## Technical details
The importer rejected forward-slash traversal sequences but left backslashes unchanged. Windows interpreted those backslashes as directory separators during extraction.
An archive member can use a path such as:
```text
upload/..\..\..\style-archive-sentinel.php
```
## Reproduction
1. Run XenForo on Windows with PHP ZIP support enabled.
2. Use an ACP account with the delegated `style` permission.
3. Create a style archive containing the traversal member shown above.
4. Import the archive through the normal style-import action.
5. Request `/style-archive-sentinel.php` from the web server.
The importer wrote the archive member into the web root, where the web server executed it as PHP.
## Impact
A delegated style administrator could write files to locations writable by the web-server process. If the web root is writable, the uploaded PHP file can execute when requested; otherwise, writes remain limited to the process's filesystem permissions.
XenForo corrected archive-path validation in 2.3.13.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-74239)
- [PoC](https://github.com/BomboBombone/CVE-2026-74239)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-path-traversal-via-style-archive-importer-on-windows)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe