CVE-2025-71282

HighPublic PoC

Published: 01 April 2026

Published

01 April 2026

Modified

01 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0004 13.5th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-71282 is a high-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Xenforo Xenforo. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-11 Error Handling good match

prevent

SI-11 requires systems to handle errors and exceptions without disclosing sensitive information such as filesystem paths in messages triggered by open_basedir restrictions.

SI-2 Flaw Remediation good match

prevent

SI-2 mandates timely flaw remediation, including patching XenForo to version 2.3.7 or later to eliminate the information disclosure vulnerability.

SI-15 Information Output Filtering good match

prevent

SI-15 enforces filtering of system outputs to remove or sanitize sensitive filesystem path information before transmission to unauthenticated users.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1083 File and Directory Discovery Discovery

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

attack.mitre.org →

Why these techniques?

Remote unauthenticated exploitation of public-facing XenForo app (T1190) directly yields filesystem paths via error messages, enabling File and Directory Discovery (T1083).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.

Deeper analysisAI

CVE-2025-71282 is an information disclosure vulnerability in XenForo forum software versions prior to 2.3.7. The issue arises when open_basedir restrictions trigger exception messages that inadvertently reveal filesystem paths, allowing attackers to enumerate the server's directory structure. Classified under CWE-209 (Generation of Error Message Containing Sensitive Information), it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility and no authentication required.

An unauthenticated attacker can exploit this vulnerability remotely by crafting requests that trigger open_basedir-protected operations, such as accessing restricted files or directories. Successful exploitation yields detailed server filesystem paths from error messages, which can aid in further reconnaissance for targeted attacks, such as identifying configuration files, backups, or other sensitive locations. No privileges, user interaction, or special conditions are needed, making it straightforward for automated scanning tools to detect and leverage.

XenForo's official release notes for version 2.3.7 confirm this as one of several security fixes, recommending immediate upgrades for affected installations. The Vulncheck advisory details the exception handling flaw and emphasizes patching to 2.3.7 or later, along with reviewing server logs for prior exploitation attempts, as no workarounds are provided beyond disabling verbose error reporting where feasible.