Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS scores by FIRST (EPSS SIG), generated by Empirical Security. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-70810 is a high-severity CSRF (CWE-352) vulnerability in Phpbb. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Internal Defacement (T1491.001); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-70810 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, affecting phpBB version 3.3.15. Published on 2026-04-09, it enables a local attacker to execute arbitrary code by targeting the login function and authentication mechanism. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity with network accessibility, low attack complexity, no privileges required, and user interaction needed.
A local attacker can exploit this CSRF flaw by crafting malicious requests that leverage the login and authentication processes, potentially leading to arbitrary code execution on the targeted phpBB instance. The attack requires user interaction, aligning with the CVSS metrics, and could compromise confidentiality, integrity, and availability if successful.
References primarily point to a GitHub Gist by researcher ariefibis (https://gist.github.com/ariefibis/80e306765c23d6fac1584dbb76822e30), the researcher's GitHub profile (https://github.com/ariefibis), and LinkedIn page (https://www.linkedin.com/in/mohammed-a-6a2548112/), which likely detail the vulnerability discovery or proof-of-concept but do not specify mitigations or patches in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209383
Vulnerability Data
Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement requires verifying that state-changing requests originate from the authenticated user rather than a forged cross-site source.
Protecting session authenticity prevents attackers from replaying or forging authenticated requests via the victim's browser.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.