CVE-2026-49954: Discuz! X5.0 Local File Inclusion RCE Vulnerability

Technical summary

CVE-2026-49954 is a local file inclusion (LFI) vulnerability in Discuz! X5.0 releases 20260320 through 20260610. The vulnerability stems from insufficient input validation in the plugin import mechanism. Attackers craft a plugin configuration file with path traversal sequences (e.g., ../) in the directory attribute. During plugin installation, a deliberate exception is triggered that circumvents sanitization routines, allowing the malicious paths to be stored without proper encoding or filtering. When the plugin system subsequently passes this unsanitized path to PHP's include() function, combined with file upload capabilities already present in the application, it results in arbitrary code execution within the web server process context. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Business impact

Organizations running affected Discuz! X5.0 installations face risk of complete server compromise if administrative credentials are compromised or if an attacker gains admin access through other means. Since the vulnerability requires high-privilege authentication, the risk is primarily to the availability and integrity of the Discuz! deployment itself. Compromised instances could be used to host malware, deface content, or pivot to other infrastructure. The impact is limited to confidentiality, integrity, and availability of the Discuz! system and potentially downstream systems that trust it.

Affected systems

The vulnerability affects Discuz! X5.0 releases published between March 20, 2026 and June 10, 2026 (inclusive). Only the X5.0 branch is impacted; other major versions require separate assessment. Organizations should identify which Discuz! release versions are currently deployed. The release date nomenclature (YYYYMMDD format) can be cross-referenced against official Discuz! changelogs to determine if your installation falls within the vulnerable window.

Exploitability

While the vulnerability has a network vector (AV:N), it requires high-privilege authentication (PR:H), meaning only admin accounts can exploit it directly. However, if an attacker gains admin credentials through credential compromise, phishing, or lateral movement, exploitation is straightforward: upload a malicious plugin configuration and trigger an exception during import to bypass validation. No user interaction is required once admin access is obtained. The low complexity rating (AC:L) indicates that the exploit path is reliable and does not depend on specific environmental conditions. This is not currently listed as actively exploited in the wild (KEV status: False as of the advisory date).

Remediation

Immediately update Discuz! X5.0 to a release version after June 10, 2026 that includes fixes for this vulnerability. Verify the specific patch version against the official Discuz! vendor advisory. Until patches are applied, restrict admin account access to trusted personnel only, enforce strong password policies, and enable multi-factor authentication for administrative accounts. Monitor admin activity logs for unusual plugin imports or file operations. Consider implementing a Web Application Firewall (WAF) rule that blocks requests containing path traversal sequences (.., ../, etc.) in plugin configuration uploads.

Patch guidance

Check the official Discuz! security advisory and vendor website for the exact patched release version for X5.0. Typically, patches will be released as a version number after 20260610 in the YYYYMMDD naming scheme, or as an explicit security patch release. Before applying patches, back up your Discuz! database and configuration files. Apply patches in a test environment first to verify compatibility with any custom plugins or modifications. After patching, clear browser caches and session data to ensure users receive the updated code.

Detection guidance

Monitor web server logs and Discuz! access logs for admin accounts performing plugin imports, particularly from unusual IP addresses or during off-hours. Look for failed plugin installation attempts that might indicate exploitation attempts triggering the exception-based bypass. Check the Discuz! plugin directory for unexpected or newly installed plugins, especially any with suspicious names or file paths. Use file integrity monitoring on the Discuz! installation directory to detect unauthorized file modifications. Network intrusion detection systems should flag HTTP requests to plugin import endpoints that contain encoded or obfuscated path traversal sequences in POST/multipart data.

Why prioritize this

Despite a HIGH CVSS score (7.2), the requirement for admin-level authentication significantly reduces the attack surface compared to unauthenticated vulnerabilities. Prioritize patching for Discuz! instances exposed to the internet or accessible to untrusted users, and those with weak admin credential hygiene. Organizations with strong administrative access controls and secured admin panels may deprioritize this below critical vulnerabilities, but should still patch within a reasonable maintenance window. The window of affected releases (March-June 2026) is finite, making it easier to identify exposure.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) that code execution grants to an attacker. However, the score is tempered by the requirement for high privileges (PR:H) and no user interaction needed (UI:N). The network attack vector (AV:N) acknowledges that the initial admin compromise could occur remotely, even though the plugin import itself is an authenticated action. The score appropriately reflects a serious but not critical vulnerability for organizations with strong access controls.

Frequently asked questions