CVE-2026-79362: Woltlab Suite Core RCE Vulnerability

CVE-2026-79362 Overview

CVE-2026-79362 is a remote code execution (RCE) vulnerability in WoltLab Suite Core (WCF) caused by cache poisoning. An authenticated low-privileged user can inject PHP code into executable cache files generated by WoltLab Suite Core. Attacker-controlled data terminates the nowdoc heredoc boundary prematurely, allowing injection of arbitrary PHP that executes when the cache file is loaded.

Affected versions include WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. WoltLab released fixed builds 6.2.6 and 6.1.23 to address the flaw.

Critical Impact

Any authenticated low-privileged account can achieve remote code execution on the underlying web server, leading to full application and potentially host compromise.

Affected Products

• WoltLab Suite Core (WCF) versions 6.1.0 through 6.1.22
• WoltLab Suite Core (WCF) versions 6.2.0 through 6.2.5
• WoltLab Suite deployments relying on the built-in DiskCacheSource cache backend

Discovery Timeline

• 2026-09-11 - CVE-2026-79362 published to NVD
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-79362

Vulnerability Analysis

WoltLab Suite Core generates PHP cache files on disk through the DiskCacheSource class. These files embed dynamic content inside a PHP nowdoc block, which is intended to prevent evaluation of user-supplied data. The nowdoc uses a static boundary identifier that an attacker can predict and reproduce in submitted content.

When attacker-controlled data contains the same closing boundary marker, the nowdoc terminates early. Everything after the injected boundary is parsed as raw PHP code by the interpreter the next time the cache file is included. The result is arbitrary PHP execution triggered by any request that loads the poisoned cache entry.

Because cache generation is available to authenticated low-privileged users through normal application workflows, exploitation does not require administrator access. The vulnerability is classified as Code Injection leading to Remote Code Execution.

Root Cause

The root cause is the use of a static, predictable nowdoc boundary when serializing user-influenced data into executable PHP cache files. Without a unique per-file boundary, input sanitization for nowdoc syntax is effectively bypassed. The patch introduces a unique random boundary per cache file, generated using ParagonIE\ConstantTime\Hex, so the closing token cannot be predicted or reproduced by an attacker.

Attack Vector

An authenticated user submits input that gets serialized into a WCF-generated cache file. The payload contains the known nowdoc boundary followed by attacker-supplied PHP. Once the cache file is written and later included by the application, the injected PHP executes in the web server context.

// Security patch: force flush of legacy cache artifacts
<?php

use wcf\system\cache\source\DiskCacheSource;

// Unconditionally clear the disk cache regardless of the active cache method in
// order to forcefully remove any v1 or v2 cache artifacts.
$cache = new DiskCacheSource();
$cache->flushAll();

Source: WoltLab/WCF commit c19789d

// Security patch: DiskCacheSource now generates a unique boundary
namespace wcf\system\cache\source;

use ParagonIE\ConstantTime\Hex;
use wcf\system\io\AtomicWriter;
use wcf\system\WCF;

Source: WoltLab/WCF commit c19789d

Detection Methods for CVE-2026-79362

Indicators of Compromise

• Unexpected or newly modified PHP files under the WCF cache directory (typically wcf/cache/) containing code outside the expected nowdoc block.
• Presence of legacy v1 or v2 cache artifacts after upgrading, which the patch explicitly clears via DiskCacheSource::flushAll().
• Web server processes spawning shells, curl, wget, or other unusual child processes originating from the PHP-FPM or Apache worker running WoltLab.

Detection Strategies

• Monitor writes to the WCF cache directory and alert on cache files whose content deviates from the nowdoc template structure.
• Inspect access logs for authenticated low-privileged accounts triggering cache regeneration endpoints with unusually large or binary-looking payloads.
• Correlate cache file writes with subsequent inclusion events and outbound network connections from the PHP runtime.

Monitoring Recommendations

• Enable PHP disable_functions audit logging and forward web server logs to a central store for retention and analysis.
• Track file integrity of the WCF installation and alert on modifications to wcfsetup/install/files/lib/system/cache/source/DiskCacheSource.class.php or generated cache artifacts.
• Review authentication logs for low-privileged accounts performing sequential actions that trigger cache builds.

How to Mitigate CVE-2026-79362

Immediate Actions Required

• Upgrade WoltLab Suite Core to 6.2.6 or 6.1.23 as announced by the vendor.
• After upgrading, verify that the disk cache has been flushed to remove any pre-patch cache artifacts that may already contain injected PHP.
• Audit user accounts for unauthorized privilege escalations or newly created administrator accounts.

Patch Information

WoltLab addressed the vulnerability in the WoltLab Suite 6.2.6 / 6.1.23 update announcement and the corresponding German announcement. The upstream fix is available in WoltLab/WCF commit c19789d, which generates a unique boundary for cache files and forcefully flushes legacy cache artifacts during upgrade.

Workarounds

• If patching cannot be applied immediately, restrict cache-generating functionality to trusted administrator accounts only.
• Manually flush the disk cache and monitor the cache directory for regenerated files with anomalous content.
• Place the WoltLab application behind a web application firewall configured to block payloads containing PHP opening tags in user submissions.

# Manually clear WCF disk cache after upgrade
rm -rf /path/to/wcf/cache/*
chown -R www-data:www-data /path/to/wcf/cache
find /path/to/wcf/cache -type f -name '*.php' -exec ls -la {} \;