CVE-2026-49954: Discuz! X5.0 RCE Vulnerability

CVE-2026-49954 Overview

CVE-2026-49954 is a local file inclusion (LFI) vulnerability in Discuz! X5.0 releases 20260320 through 20260610. The flaw allows authenticated administrators to execute arbitrary code by importing a crafted plugin configuration containing path traversal sequences in the directory attribute. An exception triggered during plugin installation bypasses sanitization, allowing malicious paths to be persisted and later passed to PHP include(). Combined with the platform's file upload functionality, this LFI escalates to arbitrary code execution running as the web server user. The issue is tracked under CWE-98: Improper Control of Filename for Include/Require Statement.

Critical Impact
Authenticated administrators can achieve remote code execution on the underlying web server, leading to full application and host compromise.

Affected Products

Discuz! X5.0 release 20260320
Discuz! X5.0 releases between 20260320 and 20260610
Discuz! X5.0 release 20260610

Discovery Timeline

2026-06-15 - CVE-2026-49954 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49954

Vulnerability Analysis

The vulnerability resides in Discuz! X5.0's plugin import workflow. When an administrator imports a plugin configuration, the application parses a directory attribute that defines where plugin assets reside. The intended sanitization routine rejects directory values containing path traversal sequences such as ../. However, when plugin installation triggers an exception mid-routine, control flow exits sanitization before the validated value is enforced. The unsanitized directory value is persisted to the plugin registry.

On subsequent requests, Discuz! retrieves the stored directory value and concatenates it into a path passed to PHP's include() function. Because the stored value contains traversal sequences, the resulting path resolves outside the intended plugin root. An attacker who has previously uploaded a PHP payload through the application's file upload features can then include that payload, achieving arbitrary code execution in the web server context.

Root Cause

The root cause is improper exception handling around input validation. Sanitization is not enforced atomically with persistence, allowing tainted data to be stored when an error path is taken. The downstream include() call then trusts the persisted value without re-validation, satisfying the [CWE-98] pattern.

Attack Vector

Exploitation requires high-privilege authenticated access as a Discuz! administrator. The attacker first uploads a PHP file disguised as a permitted asset using the application's upload features. They then craft a plugin configuration whose directory attribute contains traversal sequences pointing at the uploaded payload, and they import it through the network-accessible admin interface. Triggering the installation exception causes the malicious path to be stored, and a follow-on request invoking the plugin reaches include() with the attacker-controlled path. Technical write-ups are available from KarmaInSecurity Advisory KIS-2026-11 and the VulnCheck Advisory for Discuz X5.

Detection Methods for CVE-2026-49954

Indicators of Compromise

Unexpected PHP files in upload directories such as data/attachment/ or source/plugin/ with recent modification timestamps.
Plugin registry entries whose directory field contains .., URL-encoded traversal (%2e%2e), or absolute paths.
Web server access logs showing administrator-authenticated POST requests to plugin import endpoints followed by errors and immediate plugin enable actions.
include() warnings or PHP runtime errors referencing paths outside the plugin root.

Detection Strategies

Inspect the Discuz! plugin database table for directory values that do not match the expected source/plugin/<name>/ pattern.
Monitor file integrity on the Discuz! web root for new or modified .php files created outside scheduled deployments.
Alert on administrator session activity that imports plugin packages followed by failed installation events and subsequent successful plugin enable calls.

Monitoring Recommendations

Forward web server and PHP error logs to a centralized analytics platform and alert on include() failures referencing user-writable paths.
Audit administrator account logins, especially from new geolocations or user agents, and require multi-factor authentication where possible.
Track plugin import and enable/disable API calls and trigger review when these occur outside maintenance windows.

How to Mitigate CVE-2026-49954

Immediate Actions Required

Restrict access to the Discuz! administrator control panel using network ACLs, VPN, or IP allowlisting.
Audit existing plugin registry entries and remove any with traversal sequences or paths outside the plugin root.
Rotate administrator credentials and review recent admin activity for unauthorized plugin imports.
Remove suspicious PHP files from upload directories and validate file integrity against a known-good baseline.

Patch Information

No fixed version is referenced in the NVD entry at the time of publication. Operators should monitor the Discuz! project for an updated release that addresses the plugin import sanitization flaw. Refer to the KarmaInSecurity Bug Chaining Analysis and the Full Disclosure Mailing List Post for further technical context until a vendor fix is available.

Workarounds

Disable the plugin import feature in environments where it is not required for normal operations.
Configure the web server to deny PHP execution within upload directories using location-based rules.
Limit administrator accounts to the minimum number required and enforce strong, unique passwords with multi-factor authentication.
Deploy a web application firewall rule that blocks plugin import payloads containing path traversal characters in the directory attribute.

bash

# Example nginx configuration to deny PHP execution in upload paths
location ~* ^/data/attachment/.*\.php$ {
    deny all;
    return 403;
}

location ~* ^/data/.*\.(php|phtml|php5|php7)$ {
    deny all;
    return 403;
}