CVE-2019-25685: 
phpBB vulnerability analysis and mitigation

CVE-2019-25685 is a rejected/withdrawn CVE that describes an arbitrary file upload vulnerability in phpBB through version 3.2.3, allowing authenticated attackers to achieve remote code execution via PHAR deserialization. The vulnerability exploits the plupload functionality and the phar:// stream wrapper to upload crafted zip files containing serialized PHP objects, which are then deserialized through the imagick parameter in attachment settings. Despite being formally rejected by its CVE Numbering Authority, the underlying vulnerability was catalogued under EUVD-2019-20103 and assigned a CVSS v4 base score of 8.7 (High) (GitHub Advisory, Feedly). The advisory was published to the GitHub Advisory Database on April 5, 2026, and is classified as GHSA-7585-gxmr-v33q.

The root cause is classified as CWE-22 (Path Traversal / Improper Limitation of a Pathname to a Restricted Directory), combined with PHP object deserialization via the phar:// stream wrapper. An authenticated attacker crafts a malicious zip archive containing a serialized PHP object (leveraging a GuzzleHttp gadget chain) and uploads it through phpBB's plupload file upload functionality. When the server processes the uploaded file using the imagick parameter in attachment settings, it triggers deserialization of the embedded PHP objects via the phar:// wrapper, resulting in arbitrary file write and ultimately remote code execution. A complete, runnable JavaScript exploit performing this multi-step attack chain is publicly available on Exploit-DB (Exploit-DB, GitHub Advisory).

Successful exploitation results in complete compromise of the affected phpBB installation, with high impact to confidentiality, integrity, and availability. An authenticated attacker can write arbitrary files (e.g., PHP webshells) to the server filesystem and execute arbitrary operating system commands as the web server process. This can enable lateral movement within the hosting environment, exfiltration of sensitive forum data (user credentials, private messages), and full server takeover (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly available on Exploit-DB (EDB-46512), described as a complete, runnable JavaScript exploit that performs a multi-step attack chain to achieve arbitrary file write and RCE via PHAR deserialization (Exploit-DB). The EPSS score is approximately 0.072–0.183%, indicating a relatively low but non-negligible probability of exploitation in the wild within 30 days. There is no current evidence of active in-the-wild exploitation or threat actor attribution, and the CVE is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the phpBB instance, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Reconnaissance: Identify phpBB installations running version 3.2.3 or earlier. Confirm the instance allows file attachments and that the imagick parameter is enabled in attachment settings.
2. Obtain authenticated access: Register or use an existing low-privilege user account on the target phpBB forum.
3. Craft malicious PHAR archive: Create a zip file containing a serialized PHP object using a GuzzleHttp gadget chain designed to write a PHP webshell to a web-accessible directory on the server.
4. Upload via plupload: Use phpBB's plupload file upload functionality to upload the crafted zip file as an attachment, bypassing standard file type validation.
5. Trigger PHAR deserialization: Reference the uploaded file using a phar:// stream wrapper path through the imagick parameter in the attachment settings, causing the server to deserialize the embedded PHP objects.
6. Achieve RCE: The deserialized gadget chain writes a PHP webshell to the server. Access the webshell via HTTP to execute arbitrary commands on the underlying system (Exploit-DB, GitHub Advisory).

• Network: Unusual HTTP POST requests to phpBB's plupload endpoint (e.g., /phpbb/posting.php or attachment upload handlers) containing zip file uploads from authenticated users; outbound connections from the web server process to unknown external IPs following file uploads.
• File System: Unexpected PHP files (webshells) written to the phpBB installation directory or subdirectories (e.g., files/, images/, attachments/); presence of .phar files or zip archives with embedded serialized PHP objects in the upload directory.
• Logs: Web server access logs showing requests to attachment upload endpoints followed by requests to newly created .php files; PHP error logs containing deserialization-related errors or imagick/phar:// references; phpBB logs showing attachment uploads by low-privilege users.
• Process: Unusual child processes spawned by the web server process (e.g., sh, bash, curl, wget, python) following file upload activity (Exploit-DB).

Upgrade phpBB to a version beyond 3.2.3 that addresses this vulnerability; refer to the VulnCheck advisory and GitHub Advisory (GHSA-7585-gxmr-v33q) for specific patched version details. As interim mitigations, disable the imagick parameter in phpBB attachment settings if not required, and restrict file upload functionality to trusted users only. Implement strict file type validation and consider disabling phar:// stream wrapper support at the PHP configuration level (phar.readonly = On). Monitor attachment upload logs for suspicious activity from authenticated users (GitHub Advisory, Feedly).

The vulnerability received limited but notable attention following its April 2026 publication, with coverage on Bluesky (via the CVE tracking account) and aggregation by VulnDB and CVEFeed. A technical write-up was published at infinitsec.net shortly after disclosure. The CVE's rejected status has caused some confusion in the community, as the underlying vulnerability and associated exploit remain valid and documented under the EUVD-2019-20103 identifier (GitHub Advisory).