UBB.threads forum flaws enable RCE, SQLi
Six unpatched vulnerabilities in UBB.threads forum software allow XSS, CSRF, blind SQL injection, path traversal RCE, and DoS attacks.
CERT Polska coordinated disclosure of six vulnerabilities affecting UBB.threads forum software, reported by researchers Kamil Szczurowski and Michał Wnękowicz from Securitum. The flaws range from stored and reflected XSS and CSRF to a blind SQL injection accessible via the Members Control Panel, and a path traversal vulnerability in the template editor that can be leveraged to achieve remote code execution by reading and writing arbitrary files on the server. A separate denial-of-service issue allows an authenticated attacker to exhaust database resources by flooding profile view requests, taking the application offline for other users.
All six issues were confirmed against UBB.threads version 7.7.5, though other versions may be affected. CERT Polska notes that attempts to contact the vendor were unsuccessful, meaning no official patch or vendor advisory currently exists for any of these vulnerabilities. This leaves administrators of UBB.threads-based forums without a clear remediation path other than restricting access to sensitive functionality (Control Panel, template editing) and monitoring for anomalous input in posts, profile fields, and requests.
While there is no evidence of active exploitation in the wild, the combination of an unresponsive vendor and a path traversal flaw capable of remote code execution represents a meaningful risk for any internet-facing UBB.threads deployment. The vulnerabilities span multiple attack surfaces (client-side scripting, database access, file system, and availability), making comprehensive mitigation difficult without vendor cooperation.
Mentioned in this report
Detection guidance
UBB.threads Template Editor Path Traversal Attempt
Detects HTTP requests to the UBB.threads template editor endpoint containing directory traversal sequences, indicative of attempts to read/write arbitrary files leading to RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: UBB.threads Template Editor Path Traversal Attempt
description: Detects requests to template/style editing functionality in UBB.threads
that contain path traversal sequences or attempts to reference files outside the
template directory, consistent with the disclosed path traversal to RCE vulnerability.
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
product: apache
detection:
selection_endpoint:
cs-uri-stem|contains:
- template
- style
- editor
selection_traversal:
cs-uri-query|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- ..%5c
condition: selection_endpoint and selection_traversal
falsepositives:
- Legitimate template file browsing that references relative paths within an allowed
template directory (rare, should not include parent-directory sequences)
- Vulnerability scanners probing the application
level: high
id: 79d0563a-6603-5aa4-9a43-2c75299a7e08
status: experimental
author: Vorant
Blind SQL Injection Attempt Against UBB.threads Members Control Panel
Detects HTTP requests to profile/MCP endpoints containing time-based blind SQL injection payloads (SLEEP/BENCHMARK/WAITFOR) as described in the disclosed vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Blind SQL Injection Attempt Against UBB.threads Members Control Panel
description: Detects requests to profile or Members Control Panel endpoints that contain
classic time-based/boolean blind SQL injection payloads. Generalises on the injection
primitives rather than a specific parameter name, since the report describes a blind
SQLi reachable via MCP.
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
product: apache
detection:
selection_endpoint:
cs-uri-stem|contains:
- mcp
- profile
- members
selection_sqli:
cs-uri-query|contains:
- SLEEP(
- BENCHMARK(
- WAITFOR DELAY
- ' OR 1=1'
- UNION SELECT
- ''' AND ''1''=''1'
condition: selection_endpoint and selection_sqli
falsepositives:
- Security scanning tools or authorized penetration tests probing the same endpoints
- Rare legitimate query strings that happen to contain SQL keywords (e.g. search fields
echoing SQL-like text)
level: high
id: 59c2a446-8c6e-5fd0-b47a-980222f429f1
status: experimental
author: Vorant
Web Server Process Spawning Shell After Suspected File-Write Exploitation
Detects a web server process (Apache/Nginx/PHP-FPM/IIS worker) spawning a command interpreter, a common post-exploitation indicator following successful arbitrary file write/RCE such as the UBB.threads template editor path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell After Suspected File-Write Exploitation
description: Detects web server worker processes spawning shells or interpreters shortly
after handling requests, consistent with successful exploitation of a path-traversal/arbitrary-file-write
vulnerability (e.g. the UBB.threads template editor flaw) that drops and executes
a web shell.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-cgi
Image|endswith:
- /sh
- /bash
- /dash
- /perl
- /python
- /python3
filter_common_cgi:
CommandLine|contains:
- logrotate
- healthcheck
condition: selection and not filter_common_cgi
falsepositives:
- Legitimate CGI scripts or server-side scripting frameworks that intentionally shell
out for maintenance tasks
- Custom application deployments that invoke interpreters directly from the web server
process
level: high
id: 7b5b7a55-4abf-5db1-84a5-abac81a852ff
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-54219
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free